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MEMORANDUM  FOR  NAVAL  INSPECTOR  GENERAL 

DIRECTOR,  DEFENSE  FINANCE  AND  ACCOUNTING  SERVICE 


SUBJECT:  Internal  Controls  Over  United  States  Marine  Corps  Commercial  and  Miscellaneous 
Payments  Processed  Through  the  Deployable  Disbursing  System 
(Report  No.  D-20 10-037) 


We  are  providmg  this  report  for  your  information  and  use.  We  considered  management  comments 
on  a  draft  of  this  report  when  preparing  the  final  report.  The  Department  of  the  Navy  and  Defense 
Finance  and  Accounting  Service  comments  conformed  to  the  requirements  of  DOD 
Directive  7650.3;  therefore,  additional  comments  are  not  required.  The  complete  text  of  the 
comments  is  in  the  Management  Comments  section  of  the  report. 

We  appreciate  the  courtesies  extended  to  the  staff.  Please  direct  questions  to  me  at 
(703)  604-8900  (DSN  664-8900). 
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clAij 
Mary  L.  Ugone 
Deputy  Inspector  General 
for  Auditing 
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■s  Results  in  Brief:  Internal  Controls  Over 

)  United  States  Marine  Corps  Commercial  and 
Miscellaneous  Payments  Processed  Through 
the  Deployable  Disbursing  System 


What  We  Did 

The  objective  of  the  audit  was  to  determine 
whether  the  internal  controls  over  transactions 
processed  through  the  Deployable  Disbursing 
System  (DDS)  were  adequate  to  ensure  the 
reliability  of  the  data  processed.  The  audit 
included  financial  information  processed  by 
disbursing  stations  supporting  the  Operation 
Iraqi  Freedom  and  included  the  recording  of 
related  obligations.  We  focused  our  review  on 
United  States  Marine  Corps  (USMC) 
commercial  and  miscellaneous  payments.  The 
USMC  processed  more  than  22,870  payments  of 
at  least  $520  million  during  FYs  2006  and  2007. 

What  We  Found 

USMC  internal  controls  over  payments 
processed  through  DDS  were  not  adequate  to 
ensure  the  reliability  of  the  data  processed. 
Specifically,  USMC  did  not: 

•  properly  authorize  9,675  payment  vouchers, 
totaling  $310.4  million; 

•  separate  authorization  and  payment  duties; 

•  adequately  control  access  because  it  used 
14  multiple  user  accounts  and  14  generic  user 
accounts  to  process  a  combined  total  of 
$52.7  million  in  payments;  and 

•  maintain  a  centralized  database  of  the 
transactions  processed  through  DDS. 

In  addition,  the  USMC  made  32  duplicate 
payments,  totaling  $2.5  million  that  if  collected, 
could  be  funds  put  to  better  use.  (Appendix  C) 

The  Defense  Finance  and  Accounting  Service 
(DFAS)  did  not  design  DDS  to: 

•  provide  sufficient  functionality  for  management  to 
readily  review  and  monitor  DDS  access  and  usage; 


•  capture  the  audit  trail  for  key  payment 
information,  such  as,  certifying  officer  name, 
contract  or  requisition  numbers,  invoice 
received  date  and,  invoice  number  for  185  of 
200  payments  in  our  sample; 

•  adequately  capture  line  of  accounting 
information;  and 

•  centralize  data  for  efficient  management 
oversight  and  review. 

We  determined  the  USMC  did  record  timely 
and  sufficiently  $6.3  million  in  obligations  for 
150  commercial  and  miscellaneous  payments. 

What  We  Recommend 

We  recommend  that  the  Assistant  Deputy 
Commandant,  Programs  and  Resources 
Department,  and  Fiscal  Director  of  the  USMC, 
develop  and  implement  procedures  to: 

•  eliminate  multiple  user  accounts, 

•  minimize  system  administrators, 

•  collect  on  over  payments, 

•  review  the  DDS  data, 

•  resolve  806  missing  vouchers,  and 

•  maintain  a  centralized  DDS  database. 

We  recommend  the  Director,  DFAS,  enhance 
DDS  to  improve  the  oversight  and  review 
capabilities,  and  maintain  data  reliability. 

Management  Comments  and 
Our  Response 

The  Assistant  Secretary  of  the  Navy  (Financial 
Management  and  Comptroller)  (Acting)  and  the 
Director,  DFAS  Information  and  Technology, 
agreed  with  our  recommendations  and  the 
USMC  concurred  with  the  potential  monetary 
benefits.  Please  see  the  recommendations  table 
on  page  ii. 
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Recommendations  Table 


Entity 

Recommendations 
Requiring  Comment 

No  Additional  Comments 
Required 

Assistant  Deputy  Commandant, 
Programs  and  Resources 

Department;  and  Fiscal  Director  of 
the  United  States  Marine  Corps 

A.l.a.l,  A.l.a.2,  A.l.a.3, 

A. l.a.4,  A.l.b,  A.l.c,  A.l.d, 

B. l.a,  and  B.l.b 

Director,  Defense  Finance  and 
Accounting  Service 

A. 2.a,  A.2.b,  A.2.c,  B.l.a, 

B. l.b,  B.2.a,  B.2.b,  B.2.c, 
B.2.d,  and  B.2.e 
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Introduction 

Objective 

Our  audit  objective  was  to  determine  whether  the  internal  controls  over  transactions 
processed  through  the  Deployable  Disbursing  System  (DDS)  are  adequate  to  ensure  the 
reliability  of  the  data  processed.  The  audit  included  financial  information  on  commercial 
and  miscellaneous  payments  processed  by  disbursing  stations  supporting  the  Operation 
Iraqi  Freedom  and  included  the  recording  of  related  obligations.  Please  see  Appendix  A 
for  scope  and  methodology  and  prior  coverage  related  to  the  objective. 

Background 

On  May  22,  2008,  DOD  Inspector  General  Audit  Report  D-2008-098  “Internal  Controls 
Over  Payments  Made  in  Iraq,  Kuwait,  and  Egypt,”  addressed  a  material  internal  control 
weakness  over  in- theater  payments.  In  response  to  a  draft  of  that  report,  the  Under 
Secretary  of  Defense  (Comp trollerj/Chief  Financial  Officer  stated  that  DDS  would 
improve  the  controls.  As  follow-on  to  the  audit  of  “Internal  Controls  Over  Payments 
Made  in  Iraq,  Kuwait,  and  Egypt,”  we  reviewed  the  controls  over  commercial  and 
miscellaneous  payments  processed  through  DDS.  This  audit  is  the  second  of  a  series  of 
audits  that  addresses  DDS  internal  controls  and  the  United  States  Marine  Corps’  (USMC) 
use  of  DDS.  The  first  audit  reported  that  the  USMC  recorded  classified  information  in 
unclassified  DOD  Systems.  The  third  audit  will  report  on  the  U.S.  Army’s  mishandling 
of  classified  information  posted  in  DDS. 

Deployable  Disbursing  System 

The  Defense  Finance  and  Accounting  Service  (DFAS)  DDS  Program  Management 
Office  (PMO)  developed  DDS  to  fulfill  a  need  for  a  tactical  disbursing  system  and  to 
maintain  accountability  of  Treasury  funds  entrusted  to  disbursing  agents.  DDS  automates 
a  variety  of  disbursing  office  functions  including  travel,  military,  commercial,  and 
miscellaneous  payments;  accounts  payable;  collection  processes;  and  financial  reporting 
requirements. 

According  to  USMC  personnel,  prior  to  implementing  DDS,  the  entire  deployed 
accountability  and  disbursement  process  was  manual.  Operating  in  a  deployed 
environment  with  a  manual  process  was  unmanageable  because  the  USMC  did  not 
have  a  way  to  ensure  that  the  accountability  and  disbursement  documentation  was  being 
prepared  as  required.  The  USMC  began  using  DDS  in  FY  2006.  DDS  brought  systemic 
enforcement  of  accountability  and  disbursing  requirements  and  improved  transparency 
over  the  process. 

The  USMC  uses  DDS  at  main  sites  located  in  Camp  Pendleton,  California;  Camp 
Fejeune,  North  Carolina;  and  Camp  Foster,  Okinawa,  Japan.  In  addition,  USMC  deploys 
disbursing  personnel  from  the  main  sites  to  remote  sites  in  Southwest  Asia  (for  example. 
Camp  Fallujah,  Iraq  and  Camp  A1  Asad,  Iraq).  The  main  site  disbursing  stations 
accumulate  disbursing  data  from  their  respective  remote  sites. 
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In  FYs  2006  and  2007,  the  USMC  processed  through  DDS  more  than  22,872  commercial 
(contract  and  vendor  payments)  and  miscellaneous  payment  vouchers  totaling  at  least 
$520  million.  Miscellaneous  payments  included  condolence  payments'  and  some  travel 
and  military  payments.  Table  1  provides  a  breakout  of  commercial  and  miscellaneous 
payments  processed  through  DDS. 


Table  1,  USMC  Commercial  and  Miscellaneous  Payments 
Processed  Through  DDS  in  FYs  2006  and  2007 


Source/Type  of  Files 

Number  of  Vouchers* 

Value 

(in  millions) 

DDS  Databases 

9,675 

$310.4 

Archived  DDS  Vouchers 

13,197 

209.6 

Total 

22,872 

$520.0 

*  We  identified  at  least  806  additional  USMC  disbursements  for  whieh  the  DDS  PMO  did  not  provide  DDS 
data.  For  additional  detail,  see  Finding  B. 


Of  the  9,675  DDS  vouchers  totaling  $310.4  million,  remote  sites  in  Iraq  processed 
through  DDS  $158.7  million^  in  cash  and  check  vouchers.  The  main  sites  processed  all 
Electronic  Fund  Transfer  payments  to  include  those  payments  initiated  at  remote  sites. 

We  did  not  determine  the  method  of  payment  for  the  13,197  archived  DDS  vouchers 
totaling  $209.6  million  because  the  USMC  and  DDS  PMO  did  not  provide  this  data  in 
time  for  our  review. 

USMC  Roles  and  Responsibilities  for  Disbursing 

The  Marine  Corps  Disbursing  Operations  and  Systems  Section,  Kansas  City,  Missouri, 
provides  oversight  to  the  USMC  field  finance  and  disbursing  offices.  The  Marine  Corps 
Disbursing  Operations  and  Systems  Section  is  responsible  for  ensuring  that  USMC 
disbursing  personnel  follow  internal  controls.  The  disbursing  offices  located  at  Camps 
Pendleton,  Lejeune,  and  Foster  perform  the  day-to-day  disbursing  operations. 

USMC  Procurement  and  Disbursing  Process 

The  USMC  disbursing  cycle  starts  with  a  request  for  a  procurement  action.  The 
requestor  enters  a  procurement  request  into  the  USMC  in-theater  procurement  system. 

The  USMC  uses  the  Standard  Accounting,  Budgeting,  and  Reporting  System  (SABRS)  to 
record  the  commitment  and  obligation  of  funds  for  the  request.  Once  the  vendor  provides 
the  goods  or  services,  the  receiving  official  acknowledges  receipt  of  goods  or  services  on 
the  receiving  report.  When  the  vendor  provides  an  invoice,  the  certifier  then  reviews  the 


*  A  condolence  payment  is  an  expression  of  sympathy  for  death,  injury,  or  property  damage  caused  by 
coalition  or  U.S.  forces  generally  during  combat. 

^  The  remote  sites  processed  5,217  cash  payments  totaling  $60.4  million  and  1,122  check  payments  totaling 
$98.3  million. 
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supporting  documentation  and  certifies  the  voucher  for  payment.  When  the  voucher  and 
supporting  documentation  is  certified,  the  disbursing  office  can  make  a  payment  using 
DDS.  See  Appendix  B  for  a  detailed  discussion  and  flowchart  of  this  process. 

Federal  Financial  System  Requirements 

DDS  processes  Operation  Iraqi  Freedom  transactions  and,  based  on  the  dollar  value  of 
the  transactions  processed,  is  a  key  component  of  the  USMC  financial  system.  Office  of 
Management  and  Budget  Circular  No.  A-127,  “Financial  Management  Systems,”  July  23, 
1993,^  states  that  a  “financial  system”  is  an  information  system,  consisting  of  one  or 
more  applications,  that  an  entity  uses  to  collect,  process,  maintain,  transmit,  and  report 
data  about  financial  events. 

The  Federal  Financial  Management  Improvement  Act  of  1996  requires  that  agencies 
comply  with  Federal  accounting  standards  and  Federal  financial  management  system 
requirements  (Federal  system  requirements).  The  Office  of  Federal  Financial 
Management,  Office  of  Management  and  Budget,  issues  the  Federal  system 
requirements.  The  Office  of  Federal  Financial  Management,  Report  No.  OFFM-NO- 
0106,  “Core  Financial  System  Requirements,”  January  2006  (Core  Financial  System 
Requirements),  are  the  mandatory  functional  and  technical  requirements  that  agency 
financial  management  systems  must  meet  to  comply  with  the  Federal  Financial 
Management  Improvement  Act  of  1996.  These  requirements  stipulate  that  systems  have 
controls  over  function  access  (for  example,  transaction  access  and  authority  for  approval) 
and  data  access.  Furthermore,  the  Government  Accountability  Office,  “Federal 
Information  System  Controls  Audit  Manual,”  January  1999,  concludes  that  access 
controls  should  be  in  place  to  provide  reasonable  assurance  that  there  is  protection  of 
computer  resources  against  unauthorized  modification,  disclosure,  loss,  or  impairment. 
Inadequate  access  controls  diminish  the  reliability  of  computerized  data  and  increase  the 
risk  of  destruction  or  inappropriate  disclosure  of  data. 

According  to  the  Core  Financial  System  Requirements,  all  financial  management  systems 
must  have  security,  internal  controls,  and  accountability  built  into  the  processes  and  must 
provide  an  audit  trail.  These  requirements  also  state  that  adequate  audit  trails  are  critical 
to  providing  support  for  transactions  and  balances  maintained  by  the  core  financial 
system.  In  addition,  with  audit  trails,  agencies  are  able  to  reconcile  accounts,  research 
document  history,  and  query  data  stored  in  the  core  financial  system. 

The  Core  Financial  System  Requirements  define  rules  for  recording,  editing,  and 
processing  transactions  input  into  the  core  financial  system.  The  core  financial  system 
must  ensure  that  agencies  maintain  proper  control  of  transactions  to  provide  reasonable 
assurance  of  the  availability  of  funds  and  ensure  that  transactions  pass  other  processing 
edits.  In  addition,  the  core  financial  system  must  provide  automated  functionalities  to 
support  the  document  and  transaction  control  process,  the  invoicing  process,  the 
disbursing  process,  and  the  audit  trails  processes. 


^  A  new  version  of  Office  of  Management  and  Budget  Circular  No.  A-127,  dated  January  2009,  has  since 
superseded  this  version. 
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Review  of  Internal  Controls 

DOD  Instruction  5010.40,  “Managers’  Internal  Control  (MIC)  Program  Proeedures,” 
January  4,  2006,  requires  DOD  organizations  to  implement  a  comprehensive  system  of 
internal  controls  that  provide  reasonable  assurance  that  programs  are  operating  as 
intended  and  to  evaluate  the  effectiveness  of  the  eontrols.  We  identified  internal  control 
weaknesses  for  the  USMC.  The  USMC  did  not  have  effective  internal  controls  over  the 
authorization  of  payments,  separation  of  duties,  and  DDS  aceess.  Implementing 
Reeommendations  A.l.a  through  A.2.c  will  improve  payment  authorization  complianee, 
separation  of  duties,  and  DDS  aecess  controls  and  could  result  in  potential  monetary 
benefits  of  $2.5  million  (Appendix  C).  We  will  provide  a  copy  of  this  report  to  the  senior 
Navy  official  responsible  for  internal  controls  in  the  USMC. 
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Finding  A.  Controls  Over  Disbursement 
Authorizations  and  DDS  Access 

The  USMC  did  not  have  adequate  internal  controls  over  the  entry  of  disbursement 
transactions  and  access  to  transactions  in  DDS.  Specifically,  the  USMC  did  not: 

•  properly  authorize  9,675  payments,  totaling  $310.4  million; 

•  separate  authorization  and  payment  duties;  and 

•  adequately  control  access  because  it  used  14  multiple  user  accounts  to  process 

$5  million  in  disbursements  and  14  generic  user  accounts  to  process  $47.7  million 
in  disbursements. 

This  occurred  because  the  USMC  did  not: 

•  issue  appointment  letters  for  personnel  who  were  certifying  payment  documents 
and  did  not  comply  with  the  separation  of  duty  requirements  in  the  DOD 
Regulation  7000. 14-R,  “DOD  Financial  Management  Regulation”  (DOD  FMR), 
and 

•  have  adequate  procedures  over  the  use  and  access  of  DDS. 

In  addition,  the  USMC  did  not  establish  adequate  oversight  over  the  DDS  payment 
process  and  the  DDS  PMO  did  not  provide  sufficient  functionality  in  DDS  for 
management  to  readily  review  and  identify  access  control  weaknesses. 

As  a  result,  the  USMC  did  not  comply  with  section  3325,  title  31,  United  States  Code 
(31  U.S.C.  3325)  when  it  made  $310.4  million  in  payments.  Further,  USMC  payments 
are  at  increased  risk  for  unauthorized  modification,  erroneous  payments,  or  disclosure  of 
classified  information.  We  found  that  the  USMC  made  32  duplicate  payments,  totaling 
$2.5  million  and  mishandled  classified  information. 

Authorization  and  Access  Requirements 

The  United  States  Code  (31  U.S.C.  3325)  requires  the  USMC  to  “disburse  money  only  as 
provided  by  a  voucher  certified  by  an  officer  or  employee  of  the  executive  agency  having 
written  authorization  from  the  head  of  the  agency  to  certify  vouchers.” 

The  DOD  FMR  implements  31  U.S.C.  3325  and  Federal  financial  system  requirements. 
The  DOD  FMR  provides  guidance  on  the  authorization  and  certification  of  payment 
vouchers  and  the  separation  of  duties  between  the  certifying  and  disbursing  officials. 

In  addition,  DOD  Instruction  8500.2,  “Information  Assurance  Implementation,” 

February  6,  2003,  states  that  authorized  users  with  a  need-to-know  only  access  data  that 
applies  to  their  authorized  privileges. 
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The  Core  Finaneial  System  Requirements  address  aecess  controls.  In  addition,  the 
National  Institute  of  Standards  and  Technology,  Federal  Information  Processing 
Standards  Publication  200,  “Minimum  Security  Requirements  for  Federal  Information 
and  Information  Systems,”  March  2006,  states  that  organizations  must  limit  information 
system  access  to  authorized  users  and  to  the  types  of  transactions  and  functions  that 
authorized  users  are  permitted  to  exercise.  Furthermore,  the  Government  Accountability 
Office,  “Federal  Information  System  Controls  Audit  Manual,”  January  1999"^,  concludes 
that  access  controls  should  be  in  place  to  provide  reasonable  assurance  that  there  is 
protection  of  computer  resources  against  unauthorized  modification,  disclosure,  loss,  or 
impairment.  Limiting  access  helps  to  ensure  that: 

•  users  only  have  the  access  needed  to  perform  their  duties, 

•  user  access  is  limited  to  only  a  few  individuals,  and 

•  user  access  is  restricted  from  performing  incompatible  functions. 

Voucher  Authorization 

The  USMC  did  not  properly  authorize  vouchers  for  9,675  payments  totaling 
$310.4  million  in  accordance  with  31  U.S.C.  3325  and  the  DOD  FMR.^  For  a  payment 
to  comply  with  31  U.S.C.  3325  and  the  DOD  FMR,  a  properly  appointed  certifying 
officer  must  authorize  the  payment.  The  USMC  did  not  properly  appoint  certifying 
officials.  In  addition,  the  USMC  used  disbursing  personnel  to  both  certify  vouchers  and 
make  disbursements  which  should  have  been  duties  performed  by  separate  personnel. 

Certifying  Officer  Appointments 

The  USMC  did  not  properly  appoint  personnel  who  certified  the  9,675  vouchers  for 
payment.  We  requested  the  certifying  officer  appointment  letters  from  disbursing  offices 
at  Camps  Pendleton,  Lejeune,  and  Foster,  which  included  the  remote  sites  located  in 
Southwest  Asia  (for  example.  Camp  Fallujah,  Iraq  and  Camp  A1  Asad,  Iraq).  USMC 
disbursing  offices  were  unable  to  provide  any  certifying  officer  appointment  letters. 
USMC  officials  confirmed  that  none  of  the  disbursing  offices  had  certifying  officer 
appointment  letters.  USMC  personnel  were  not  aware  that  they  had  not  complied  with 
31  U.S.C.  3325. 

Separation  of  Duties 

The  USMC  did  not  maintain  separation  of  duties  between  certifying  vouchers  and 
disbursing  funds  for  9,675  payments.  The  separation  of  duties  were  lacking  because 
disbursing  office  personnel  who  authorized  payments  also  disbursed  funds.  That  is,  the 


^  The  Federal  Information  System  Controls  Audit  Manual  was  revised  in  February  2009;  however,  the 
January  1999  version  was  in  effeet  at  the  time  we  tested  USMC  internal  eontrols  and  DDS  data. 

*  We  did  not  review  the  arehived  transaetions  for  entry  and  aeeess  eontrols  beeause  the  data  was  not 
available  at  the  time  of  the  review. 
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same  individual  who  authorized  vouehers  for  payment  also  input  and  paid  the  voueher  in 
DDS.  DOD  FMR,  volume  5,  ehapter  33,  states  that  a  disbursing  offieer  is  not  eligible  for 
appointment  as  a  eertifying  offieer  and  may  not  appoint  a  eertifying  offieer.  USMC 
personnel  stated  that  their  aetions  eomplied  with  DOD  FMR,  volume  10,  chapter  8, 
which  states,  “The  disbursing  office  and  designated  representatives  qualify  as  certifying 
officers  and  may  certify  vouchers  for  payment.”  However,  certain  conditions  have  to 
exist  for  disbursing  personnel  to  act  as  certifying  officers.  The  DOD  FMR,  volume  5, 
chapter  33,  states  that  an  individual  may  be  appointed  as  a  certifying  officer  under  the 
direct  supervision  of  a  disbursing  officer  in  special,  limited  situations,  which  include 
tactical  operations.  Those  special  appointments  require  “direct  written  notification  from 
the  respective  Head  of  the  DOD  Component  to  the  designated  appointee,  or  by  delegation 
through  command  channels  excluding  the  disbursing  officer.”  The  USMC  did  not 
provide  an  appointment  letter  or  justification  for  using  the  same  person  to  certify  a 
voucher  and  disburse  funds  for  payment. 

DOD  FMR,  volume  5,  chapter  1  further  delineates  DOD  policy  for  the  separation  of 
the  voucher  certifying  and  disbursing  functions.  Volume  5  requires  the  separation 
of  duties  related  to  disbursement  functions  such  as  authorizing,  approving,  and  recording 
transactions;  making  payments;  preparing  and  signing  checks;  and  certifying  funding. 

On  August  27,  2008,  we  informed  the  USMC  that  they  had  not  complied  with  31  U.S.C. 
3325.  The  USMC  created  a  policy  memorandum  on  September  8,  2008,  to  change  their 
disbursing  practices  to  comply  with  3 1  U.S.C.  3325.  We  have  verified  that  the  USMC 
has  implemented  this  policy  and,  as  a  result,  we  are  not  making  a  recommendation 
addressing  the  issue. 

Access  Controls 

The  USMC  did  not  maintain  proper  access  controls  to  protect  DDS  transactions  from 
increased  risk  of  fraud,  waste,  and  abuse.  Specifically,  the  USMC: 

•  assigned  multiple  user  accounts  to  individual  DDS  users, 

•  created  generic  user  accounts  in  DDS  that  were  not  assigned  to  specific 
individuals, 

•  assigned  substitute  user  accounts  for  outside  agents^  that  did  not  have  access  to 
DDS,  and 

•  assigned  system  administrator  access  to  an  excessive  number  of  user  accounts. 

Multiple  User  Accounts 

The  USMC  circumvented  DDS  controls  by  assigning  multiple  user  accounts  to 
57  individual  users  in  DDS  (see  Table  2).  An  individual  with  more  than  one  user  account 


^  Agents  of  the  disbursing  office  include  appointments  with  the  responsibilities  of  a  disbursing,  paying,  or 
collection  agent. 
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has  the  ability  to  bypass  separation  of  duties  to  process  disbursing  transactions. 
Individuals  with  multiple  user  accounts  can  access  several  privileges  within  DDS  that  are 
not  available  to  a  single  user  account.  A  privilege  allows  a  user  to  perform  assigned 
disbursing  functions  within  DDS.  These  privileges  include  system  administrator, 
accounting,  payment  certification,  check  printing,  and  voucher  input. 

We  identified  14  users  who  processed  296  vouchers  for  approximately  $5  million  by 
using  multiple  user  accounts.  In  one  instance,  a  single  user  from  Camp  Foster  created  a 
system  certified  cash  disbursement  using  two  user  accounts.  The  voucher  supporting 
documentation  shows  that  this  same  individual  signed  as  a  certifying  official  on  the  DDS 
printed  voucher,  a  sub-voucher,  and  the  contract. 


Table  2.  USMC  Multiple  User  Accounts  FYs  2006  and  2007 


Location 

Number  of  Multiple 
User  Accounts 

Number  of 
Vouchers 
Processed 

Value 

(in  Millions) 

Created 

Used 

Camp  Lejeune 

21 

3 

34 

$1.9 

Camp  Foster 

10 

8 

185 

1.3 

Camp  Pendleton 

26 

3 

77 

1.8 

Total 

57 

14 

296 

$5.0 

Existing  DDS  controls  reduce  the  risk  of  using  one  user  account  to  process  a  transaction 
from  beginning  to  end.  The  DDS  controls  limit  the  types  of  privileges  assigned  to  a 
single  user  account.  For  example,  if  a  user  account  is  assigned  agent  privilege,  DDS  will 
disable  the  deputy  agent  and  vault  privileges.^  DDS  also  issues  a  warning  message  if  the 
system  administrator  attempts  to  assign  a  single  user  the  agent  privilege  and  additional 
privileges  such  as,  system  administrator,  print  checks,  and  certify  disbursement  voucher. 
The  USMC  circumvented  the  DDS  controls  by  creating  multiple  user  accounts  within 
DDS  to  process  electronic  funds  transfers  and  to  perform  the  duties  of  absent  deputy 
disbursing  officers.  The  user  account  list* *  in  DDS  does  not  show  the  system  privileges 
assigned  to  users.  DFAS  should  add  the  user  privileges  to  the  DDS  user  account  lists  so 
management  can  readily  identify  assigned  privileges  when  reviewing  and  monitoring 
DDS  user  access. 

The  USMC  should  establish  and  implement  procedures  that  require  management  and 
oversight  personnel  to  review  DDS  user  account  lists  and  monitor  user  access.  A  review 
for  multiple  user  accounts  and  privileges  should  be  a  USMC  oversight  function.  The 


’  A  vault  privilege  provides  the  user  the  capability  to  adjust  the  amount  of  cash  that  is  in  the  disbursing 
station’s  vault.  DDS  maintains  an  inventory  of  cash. 

*  A  user  account  list  provides  the  name  of  the  user,  user  ID,  and  the  user’s  outstanding  fund  balance. 
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procedures  should  eliminate  the  use  of  multiple  user  accounts,  thus  removing  the  risk  of 
misuse  of  the  accounts  and  privileges.  If  the  USMC  requires  multiple  user  accounts  for 
rare  mission  critical  circumstances,  the  procedures  should  require  justification. 

Generic  User  Accounts 

The  USMC  established  44  generic  user  accounts  that  allow  individuals  access  to  DBS 
without  identification  of  who  processed  transactions  in  DBS  (see  Table  3).  Generic  user 
accounts  in  BBS  are  not  specific  to  an  individual,  for  example,  MEU  TWENTYSIX, 
SYSTEM  ABMIN,  INPUT  BATA,  or  ANOTHER  AGENT.  We  identified  that 
14  generic  user  accounts  processed  I,I9I  vouchers  in  BBS  for  $47.7  million.  Eor 
example,  USMC  personnel  used  the  generic  user  account,  PAY  AGENT,  to  create, 
certify,  and  pay  440  vouchers  for  $35.2  million  in  BBS.  The  USMC  cannot  trace  the 
vouchers  to  a  specific  user  to  identity  who  input,  certified,  or  paid  the  vouchers  in  BBS. 
In  another  instance,  one  generic  user  by  the  name  of  PAY  AGENT,  created  and  paid 
364  of  the  system  voids^  in  BBS.  Because  the  USMC  used  generic  user  accounts  to 
process  the  system-voided  transactions,  we  could  not  identify  the  individual  responsible 
for  processing  the  transactions,  the  nature  of  the  transactions,  or  the  cause  of  the  system 
voids.  In  addition,  the  USMC  and  BBS  information  technology  specialists  could  not 
provide  an  explanation  as  to  why  these  transactions  were  system  voided. 


Table  3,  USMC  Generic  User  Accounts  FYs  2006  and  2007 


Location 

Number  of 
Generic  User 
Accounts 

Number  of 
Vouchers 
Processed 

Value 

(in  Millions) 

Created 

Used 

Camp  Lejeune 

22 

4 

209 

$1.6 

Camp  Foster 

2 

0 

0 

0 

Camp  Pendleton 

20 

10 

982 

46.1 

Total 

44 

14 

1,191 

$47.7 

USMC  personnel  stated  that  they  created  and  used  generic  user  accounts  so  they  could; 

•  perform  the  archive  and  purge  function, 

•  provide  users  a  backup  account  if  other  user  accounts  are  suspended. 


^  A  system  void  is  a  transaction  that  was  not  completed  because  of  an  interruption  such  as  power  loss  or 
system  restart,  for  which  DDS  maintains  a  voucher  number  associated  with  that  unpaid  transaction. 
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•  relieve  staffing  issues,  and 

•  set  up  DDS  at  deployed  sites. 

The  eleetronie  signature  bloek  in  the  DDS  user  setup  sereen  does  not  require  the  system 
administrator  to  input  the  title  within  the  disbursing  offiee  that  eorrelates  to  the 
appointment  letters.  DFAS  should  update  the  DDS  signature  bloek  to  require  the  system 
administrator  to  seleet  from  a  drop-down  list,  the  title  within  the  disbursing  offiee  that 
eorrelates  to  the  individual  appointment  letters.  By  having  to  seleet  a  title  that 
eorresponds  to  the  appointment  letter,  this  would  mitigate  the  risk  the  system 
administrator  would  ereate  a  generie  user  aeeount. 

On  August  27,  2008,  we  informed  the  USMC  of  the  problem  with  using  generie  user 
aeeounts.  The  USMC  established  policy  on  September  8,  2008,  that  requires  the 
elimination  of  generic  user  accounts.  We  have  verified  that  the  USMC  has  implemented 
this  policy  and,  as  a  result,  we  are  not  making  a  recommendation  addressing  the  issue.  In 
addition,  the  USMC  should  periodically  review  the  DDS  user  account  list  for  the  use  of 
generic  user  accounts.  To  ensure  the  USMC  properly  paid  these  transactions  that  used 
multiple  and  generic  user  accounts,  the  USMC  should  review  the  transactions.  The 
USMC  should  initiate  administrative  action  against  the  responsible  DDS  user  if  they 
identify  improper  payments  associated  with  the  multiple  and  generic  user  accounts. 

Substitute  User  Accounts 

The  USMC  assigned  18  substitute  user  accounts  to  track  the  accountability  of  outside 
agents;  however,  the  substitute  user  accounts  do  not  allow  for  the  identification  of  the 
individuals  who  actually  processed  the  disbursement  transactions  in  DDS.  The  USMC 
created  the  substitute  user  accounts  in  DDS  for  outside  agents  working  remotely  from  the 
Camp  Lejeune  disbursing  office  and  who  did  not  have  access  to  DDS.  These  substitute 
user  accounts  were  available  to  Camp  Lejeune  disbursing  office  personnel  and  not 
available  to  the  actual  agent  assigned  to  the  user  account.  The  agents  provided  their 
payment  supporting  documentation  to  the  disbursing  office  to  be  processed.  Disbursing 
office  personnel  accessed  DDS  using  the  corresponding  agent’s  user  account  (substitute 
account)  to  track  the  accountability  of  the  agent.  We  identified  that  2  of  the  18  substitute 
user  accounts  had  processed  3  vouchers  in  DDS  beginning  in  March  2007.  Camp 
Lejeune  personnel  informed  us  of  their  use  of  substitute  user  accounts  in  April  2008. 

DDS  requires  each  agent  to  have  an  assigned  user  account  in  order  to  establish 
accountability,  but  does  not  capture  the  identity  of  the  substitute  user  who  actually 
processed  the  transactions  for  outside  agents.  According  to  the  DDS  PMO,  the  Camp 
Lejeune  disbursing  office  did  not  have  an  alternative  way  to  process  the  transactions  that 
outside  agents  made  because  the  outside  agents  do  not  have  physical  access  to  DDS. 
DFAS  should  create  a  user  role  for  substitute  users  in  DDS  to  identify  the  individual  who 
actually  processed  the  transaction. 
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System  Administrator  Access 

The  USMC  assigned  the  system  administrator  privilege  to  32  out  of  52,  or  62  pereent,  of 
the  individual  user  aecounts  in  DDS  (see  Table  4).  This  privilege  allows  the  user  to 
access  the  user  setup  screen,  which  includes  Privacy  Act  information  of  DDS  users,  such 
as  their  social  security  number  and  name.  The  system  administrator  privilege  allows  the 
user  to: 


•  manipulate  DDS  transaction  data, 

•  grant  or  deny  user  access  by  creating  user  accounts, 

•  update  user  accounts, 

•  assign  access  privileges, 

•  reset  passwords, 

•  activate  or  deactivate  accounts, 

•  back  out  transactions  already  certified  or  paid,  and 

•  archive  and  purge  data. 


Table  4,  USMC  System  Administrator  Privilege  FYs  2006  and  2007 


Location 

Number  of 
Main  Site  User 
Accounts 

Number  of 
User  Accounts 
With  System 
Administrator 
Privilege 

Percentage  of 
User  Accounts 
With  System 
Administrator 
Privilege 

Camp  Lejeune 

20 

19 

95 

Camp  Foster 

9 

4 

44 

Camp  Pendleton 

23 

9 

39 

Totals  and  Percentage 

52 

32 

62 

USMC  personnel  stated  that  they  needed  to  assign  the  system  administrator  privilege  to 
back  out  transactions.  However,  the  USMC  did  not  have  procedures  for  documenting 
and  monitoring  assignments  of  the  system  administrator  privilege.  The  USMC  should 
establish  and  implement  these  procedures  such  as  reviewing  the  DDS  user  account  list  to 
ensure  they  provide  the  system  administrator  privilege  to  the  minimum  number  of  users 
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necessary.  Inadequate  controls  over  DDS  access  and  usage  place  payment  transactions  at 
increased  risk  for  unauthorized  modification,  disclosure,  or  erroneous  payments. 

Results  of  Internal  Control  Weaknesses 

The  USMC  internal  control  weaknesses  over  payment  authorizations  place  payments  at 
increased  risk  for  unauthorized  modification,  erroneous  payments,  or  disclosure  of 
classified  information.  We  found  that  the  USMC  made  duplicate  payments  and 
mishandled  classified  information. 

Duplicate  Payments 

The  USMC  made  32  duplicate  payments  totaling  $2.5  million  to  vendors  for  goods  and 
services  and  did  not  take  collection  on  these  erroneous  payments.  We  reviewed  DDS 
commercial  and  miscellaneous  payments  made  in  FYs  2006  and  2007  for  selective 
attributes  and  identified  32  duplicate  payments  totaling  $2.5  million.  These  duplicate 
payments  included  instances  where,  the  USMC: 

•  overpaid  a  vendor  $225,064  by  paying  the  same  invoice  three  times; 

•  made  a  cash  payment  and  a  check  or  electronic  funds  transfer  payment  for  the 
same  goods  or  services; 

•  paid  for  the  same  invoice  and  receiving  report  at  multiple  locations;  and 

•  made  at  least  nine  duplicate  payments  totaling  $0.5  million  to  one  contractor.  For 
example,  in  January  2007,  USMC  made  a  $28,000  check  payment  to  this 
contractor  against  a  numbered  invoice  for  goods  received  in  November  2006.  In 
September  2007,  the  USMC  made  a  $28,000  cash  payment  to  this  contractor  from 
a  different  disbursing  station  for  the  same  goods  and  services  for  November  2006, 
but  this  time  using  a  different  invoice  number  and  the  same  receiving  report. 

We  have  referred  34  duplicate  and  triplicate  payments  to  the  Defense  Criminal 
Investigative  Service  for  followup.  We  provided  the  USMC  with  evidence  of 
17  duplicate  payments  in  September  2008  and  requested  a  response.  In  June  2009,  the 
USMC  provided  evidence  that  they  had  taken  collection  on  two  of  the  duplicate 
payments.  The  Government  could  put  to  better  use  the  $2.5  million  in  duplicate 
payments  by  initiating  collection  on  the  32  remaining  duplicate  payments  from  the 
companies  who  received  the  duplicate  payments.  The  USMC  should  research  and  initiate 
collection  procedure  where  warranted  for  duplicate  payments.  In  addition,  the  USMC 
should  develop  and  implement  procedures  to  conduct  periodic  reviews  of  DDS  data  to 
identify  anomalies,  which  could  indicate  potential  illegal  and  improper  payments.  See 
Appendix  C  for  the  Summary  of  Potential  Monetary  Benefits. 

Classified  Information 

The  USMC  disclosed  classified  information  from  33  payments  in  two  unclassified  DOD 
systems:  DDS  and  Electronic  Document  AccessWoucher  Processing  System 
(EDA/VPS).  DDS  captures  disbursement  information  and  makes  payments,  and 
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EDAA^PS  maintains  voucher  documentation  for  commercial  and  miscellaneous 
payments  processed.  DDS  feeds  disbursement  data  to  EDAA^PS,  which  provides  access 
to  documents  used  to  support  the  procurement,  contract  administration,  bill  paying,  and 
accounting  processes.  Because  DDS  and  EDAA^PS  are  unclassified  systems,  these 
systems  should  not  contain  classified  information. 

As  a  result  of  identifying  these  vouchers  in  EDAA^PS,  DP  AS  shut  the  system  down  to 
remove  identified  classified  information  on  November  6,  2008,  and  as  of  December  3, 
2008,  DPAS  and  the  EISMC  had  removed  32  of  the  33  vouchers  we  identified  as 
containing  classified  information.  In  addition,  the  EISMC  entered  data  from 
four  disbursement  vouchers  containing  classified  information  in  the  “Payee's  Name  and 
Address”  and  in  the  “Payee”  fields  in  DDS. 

The  USMC  took  corrective  actions  in  response  to  DOD  IG  Report  No.  D-2009-054, 
“Identification  of  Classified  Information  in  Unclassified  DOD  Systems  During  the  Audit 
of  Internal  Controls  and  Data  Reliability  in  the  Deployable  Disbursing  System,” 

Pebruary  17,  2009.  The  USMC  developed  policy  to  ensure  that  finance  personnel  can 
identify  classified  information  and  remove  it  before  entering  it  into  unclassified  systems. 
In  addition,  the  USMC  researched  and  identified  DDS  disbursement  transactions 
containing  classified  information  and  removed  the  transactions  from  the  system,  as  a 
result,  we  are  not  making  a  recommendation  on  this  issue. 

Conclusion 

USMC  disbursing  personnel  had  not  complied  with  statute  when  authorizing  vouchers  for 
payment,  not  separated  certifying  and  disbursing  duties  when  making  payments,  and 
circumvented  internal  controls  for  access  to  DDS  information.  The  USMC  needs  to 
strengthen  its  procedures  and  management  oversight  of  disbursing  operations  to  prevent 
disbursing  personnel  from  making  unauthorized,  duplicate,  and  improper  payments. 

These  procedures  should  address  the  disbursement  process  to  ensure  disbursing  personnel 
are  making  payments  in  accordance  with  legal  and  DOD  PMR  requirements.  In  addition, 
these  procedures  should  address: 

•  proper  voucher  certification  requirements, 

•  separating  voucher  certification  and  payment  functions, 

•  written  justification  for  using  multiple  user  accounts, 

•  eliminating  of  the  use  of  generic  accounts, 

•  minimizing  number  of  users  with  the  system  administrator  privilege,  and 

•  periodic  reviews  of  DDS  data  to  identify  anomalies  that  could  indicate  potential 
illegal  and  improper  payments. 

In  addition,  the  DDS  PMO  did  not  provide  sufficient  functionality  in  DDS  for 
management  to  readily  identify  the  assignment  of  multiple  user  accounts,  generic  user 
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accounts,  substitute  user  aeeounts,  and  an  exeessive  number  of  system  administrators. 
DFAS  should  make  the  following  improvements  to  DDS: 

•  update  the  DDS  signature  bloek  to  require  the  System  Administrator  to  seleet  the 
appointment  that  eorrelates  to  the  individual  appointment  letters, 

•  add  user  privileges  to  the  DDS  user  aeeount  list,  and 

•  develop  a  user  role  that  identifies  the  substitute  user  proeessing  DDS  transactions 
for  outside  agents. 

DOD  depends  on  responsible  officials  to  make  payments  and  to  oversee  the  disbursement 
of  Government  funds.  When  DOD  disbursing  personnel  are  responsible  for  disbursing 
Government  funds,  strong  internal  eontrols  over  the  disbursing  operations  are  eritieal  to 
reduee  the  risk  of  improper  payments  or  fraudulent  aetivity. 

Recommendations,  Management  Comments,  and  Our 
Response 

A.l.  We  recommend  that  the  Assistant  Deputy  Commandant,  Programs  and 
Resources  Department;  and  Fiscal  Director  of  the  United  States  Marine  Corps: 

a.  Develop  and  implement  procedures  to: 

1)  Eliminate  the  use  of  multiple  user  accounts  in  the  Deployable 

Disbursing  System  and  require  justification  for  rare  circumstances 
when  multiple  users  are  necessary. 

Department  of  the  Navy  Comments 

The  Assistant  Secretary  of  the  Navy  (Finaneial  Management  and  Comptroller)  (Acting) 
agreed.  The  USMC  established  poliey  to  eliminate  the  use  of  multiple  user  aeeounts  and 
require  justifieation  when  it  is  neeessary  to  use  a  multiple  user  aeeount.  He  stated  that 
the  USMC  validated  eomplianee  with  this  policy  and  that  all  offices  are  in  eomplianee. 

Our  Response 

Comments  from  the  Assistant  Seeretary  of  the  Navy  (Finaneial  Management  and 
Comptroller)  (Aeting)  are  responsive  and  no  additional  eomments  are  required.  The 
September  8,  2008,  USMC  policy  did  not  specifically  address  the  assignment  of  multiple 
user  aeeounts  to  a  single  individual.  However,  on  November  5,  2009,  the  USMC 
provided  the  audit  team  with  the  Marine  Corps  Administrative  Analysis  Team 
Disbursing/Finanee  Offiee  Cheeklist  and  Standards.  The  USMC  uses  the  eheeklist  to 
eonduct  formal  unannouneed  annual  inspeetions.  The  eheeklist  includes  a  review  to 
determine  whether  Disbursing  Officer  or  Finance  Office  adheres  to  separation  of  duties 
within  the  Deployed  Disbursing  System. 
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2)  Minimize  the  number  of  users  with  the  system  administrator 
privilege. 

Department  of  the  Navy  Comments 

The  Assistant  Secretary  of  the  Navy  (Financial  Management  and  Comptroller)  (Acting) 
agreed.  The  USMC  established  policy  to  restrict  system  administrator  privileges  to  those 
individuals  who  have  no  other  duties  or  roles  within  DDS.  He  stated  that  the  USMC 
validated  compliance  with  this  policy  and  that  all  offices  are  in  compliance. 

Our  Response 

Comments  from  the  Assistant  Secretary  of  the  Navy  (Financial  Management  and 
Comptroller)  (Acting)  are  responsive  and  no  additional  comments  are  required.  The 
September  8,  2008,  USMC  policy  did  not  specifically  address  the  excessive  number  of 
users  assigned  the  system  administrator  privilege.  However,  on  November  5,  2009,  the 
USMC  provided  the  audit  team  with  a  list  of  system  administrators  demonstrating  that 
they  had  deactivated  many  users  with  the  system  administrator  privilege. 

3)  Review  Deployable  Disbursing  System  user’s  access,  including  the  use 
of  multiple  and  generic  user  accounts  and  system  administrator 
privilege,  to  ensure  separation  of  duties. 

Department  of  the  Navy  Comments 

The  Assistant  Secretary  of  the  Navy  (Financial  Management  and  Comptroller)  (Acting) 
agreed.  The  USMC  established  policy  to  eliminate  generic  user  accounts  and  system 
administrator  privileges,  and  to  ensure  separation  of  duties.  He  stated  that  the  USMC 
validated  compliance  by  with  this  policy  and  that  all  offices  are  in  compliance. 

Our  Response 

Comments  from  the  Assistant  Secretary  of  the  Navy  (Financial  Management  and 
Comptroller)  (Acting)  are  responsive  and  no  additional  comments  are  required.  The 
September  8,  2008,  USMC  policy  did  not  specifically  address  the  review  for  multiple 
user  accounts  and  an  excessive  number  of  system  administrators.  However,  on 
November  5,  2009,  the  USMC  provided  the  audit  team  with  the  Marine  Corps 
Administrative  Analysis  Team  Disbursing/Finance  Office  Checklist  and  Standards, 
which  the  USMC  uses  to  conduct  formal  unannounced  annual  inspections.  The  checklist 
includes  a  review  to  determine  whether  Disbursing  Officer  or  Finance  Office  adheres  to 
separation  of  duties  within  the  Deployed  Disbursing  System. 
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4)  Conduct  periodic  reviews  of  Deployable  Disbursing  System  data  to 
identify  anomalies,  which  could  indicate  potential  illegal  and 
improper  payments.  When  warranted,  the  United  States  Marine 
Corps  should  initiate  collection  procedures  on  identified  improper 
payments. 

Department  of  the  Navy  Comments 

The  Assistant  Secretary  of  the  Navy  (Financial  Management  and  Comptroller)  (Acting) 
agreed.  He  stated  the  USMC  conducts  monthly  and  annual  reviews  along  with  formal 
unannounced  reviews  of  DDS  to  identify  anomalies  that  could  indicate  illegal  and 
improper  payments  and,  when  warranted,  to  initiate  corrective  action. 

Our  Response 

Comments  from  the  Assistant  Secretary  of  the  Navy  (Financial  Management  and 
Comptroller)  (Acting)  are  responsive  and  no  additional  comments  are  required.  The 
USMC  provided  the  audit  team  with  the  Marine  Corps  Administrative  Analysis  Team 
Disbursing/Finance  Office  Checklist  and  Standards  on  November  5,  2009.  The  checklist 
includes  a  standard  of  establishing  an  effective  Internal  Control  Audit  Program  to  prevent 
or  discover  unauthorized,  fraudulent,  or  otherwise  irregular  transactions  or  activities.  In 
addition,  on  November  13,  2009,  the  Deputy  Director,  Marine  Corps  Disbursing 
Operations  and  Systems  Section,  stated  that  the  USMC  is  working  with  DFAS  to  develop 
a  DDS  query  function  to  identify  potential  duplicate  payments. 

b.  Perform  reviews  of  Deployable  Disbursing  System  procedures  implemented 
in  Recommendations  A,l,a,l-4  during  periodic  reviews  of  disbursing  offices. 

Department  of  the  Navy  Comments 

The  Assistant  Secretary  of  the  Navy  (Financial  Management  and  Comptroller)  (Acting) 
agreed.  He  stated  that  USMC’s  policy  requires  offices  to  conduct  internal  assessments  of 
compliance  regarding  DDS  profiles  and  access  every  60  days.  In  addition,  the  USMC 
conducts  annual  informal  on-site  reviews  and  formal  unannounced  inspections  to  ensure 
compliance  with  regulations  and  policy  memorandums. 

Our  Response 

Comments  from  the  Assistant  Secretary  of  the  Navy  (Financial  Management  and 
Comptroller)  (Acting)  are  responsive  and  no  additional  comments  are  required. 

c.  Review  the  transactions  processed  using  multiple  and  generic  user  accounts 
to  ensure  the  payments  were  proper.  The  United  States  Marine  Corps 
should  initiate  administrative  action  against  the  responsible  Deployable 
Disbursing  System  user  if  they  identify  improper  payments  associated  with 
the  multiple  and  generic  user  accounts. 
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Department  of  the  Navy  Comments 

The  Assistant  Secretary  of  the  Navy  (Financial  Management  and  Comptroller)  (Acting) 
agreed.  He  stated  they  examined  transactions  processed  by  the  multiple  and  generic  user 
accounts  as  part  of  USMC’s  monthly  and  annual  reviews.  The  USMC  did  not  identify 
any  improper  payments  associated  with  those  multiple  and  generic  user  accounts. 

Our  Response 

Comments  from  the  Assistant  Secretary  of  the  Navy  (Financial  Management  and 
Comptroller)  (Acting)  are  responsive  and  no  additional  comments  are  required. 

d.  Review  the  Deployable  Disbursing  System  payments  for  FY  2006  and 
FY  2007  for  duplicate  payments  and  collect  the  over  payments. 

Department  of  the  Navy  Comments 

The  Assistant  Secretary  of  the  Navy  (Financial  Management  and  Comptroller)  (Acting) 
agreed.  The  USMC  conducts  reviews  on  a  monthly  and  annual  basis.  He  stated  they 
have  or  will  resolve  24  of  the  32  duplicate  payments  using  a  collection  or  a  reduced 
payments  voucher.  He  stated  that  8  of  the  32  duplicate  payments  remain  outstanding,  but 
that  the  USMC  has  issued  demand  letters  to  the  vendors. 

Our  Response 

Comments  from  the  Assistant  Secretary  of  the  Navy  (Financial  Management  and 
Comptroller)  (Acting)  are  responsive  and  meet  the  intent  of  the  recommendation.  The 
USMC  provided  collection  vouchers  for  1 1  of  the  32  duplicate  payments  representing 
cash  collections  or  offsets  totaling  $0.9  million.  The  USMC  also  provided  two  demand 
letters  requesting  repayment  for  overpayments.  We  have  provided  the  remaining 
duplicate  payments  to  Defense  Criminal  Investigative  Service  for  followup.  On 
November  13,  2009,  the  Deputy  Director,  Marine  Corps  Disbursing  Operations  and 
Systems  Section,  stated  that  the  USMC  is  working  with  DFAS  to  develop  a  DDS  report 
to  identify  potential  duplicate  payments.  On  November  24,  2009,  the  Deputy  Director 
stated  the  USMC  will  complete  the  review  for  duplicate  payments  by  September  1,  2010. 

A,2,  We  recommend  that  the  Director,  Defense  Finance  and  Accounting  Service: 

a.  Update  the  Deployable  Disbursing  System  signature  block  to  require  the 
System  Administrator  to  select  the  appointment  that  correlates  to  the 
individual  appointment  letters. 

b.  Add  user  privileges  to  the  Deployable  Disbursing  System  user  account  list. 

c.  Develop  a  user  role  that  identifies  the  substitute  user  processing  Deployable 
Disbursing  System  transactions  for  outside  agents. 


17 


Defense  Finance  and  Accounting  Service  Comments 

The  Director,  DFAS  Information  and  Technology,  agreed.  DFAS  has  written  System 
Change  Requests  to  add  user  privileges  to  the  DDS  user  account  list  and  to  develop  a  user 
role  identifying  substitute  users.  The  Strategic  Disbursing  Initiative  Change  Control 
Board  will  consider  these  modifications  and  schedule  completion  dates  at  its  next 
scheduled  meeting  in  January  2010. 

Our  Response 

Comments  from  the  Director,  DFAS  Information  and  Technology,  are  responsive  and  no 
additional  comments  are  required. 

Management  Comments  on  the  Potential  Monetary 
Benefits  and  Our  Response 

The  United  States  Marine  Corps  Comments 

We  followed  up  with  the  USMC  to  determine  whether  they  agreed  with  the  potential 
monetary  benefits  identified  in  the  report.  On  November  17,  2009,  the  Deputy  Director, 
Marine  Corps  Disbursing  Operations  and  Systems  Section,  confirmed  that  the  USMC 
concurs  with  the  potential  monetary  benefits. 

Our  Response 

Comments  from  the  USMC  are  responsive  and  no  additional  comments  are  required. 
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Finding  B.  Reliability  of  USMC  Payment  Data 

The  USMC  commercial  and  miscellaneous  payment  data  processed  through  the  USMC 
financial  system  was  incomplete  and  inaccurate.  Specifically,  the  USMC  financial 
system,  which  includes  DDS,  did  not: 

•  maintain  complete  or  accurate  certifying  officer,  contract  or  requisition  numbers, 
invoice  received  date,  or  invoice  number  data  for  185  out  of  200  payments 
reviewed; 

•  adequately  capture  the  line  of  accounting  information;  and 

•  maintain  a  complete  set  of  DDS  data  and  all  the  data  elements  that  make  up  a 
finalized  transaction. 

This  occurred  because: 

•  the  USMC  did  not  have  an  integrated  entitlement  system  and,  as  a  result, 
manually  entered  key  commercial  payment  information  into  the  USMC  financial 
system  using  DDS; 

•  there  was  a  delay  between  the  time  the  user  entered  new  accounting  line 
information  and  the  time  DDS  saved  the  new  accounting  line  information  to  the 
DDS  database;  and 

•  the  USMC  did  not  maintain  a  centralized  DDS  database  and  the  DDS  archive 
process  did  not  capture  all  data  elements. 

As  a  result,  the  USMC  financial  system  did  not  have  adequate  audit  trails  for  payment 
transactions  and  did  not  comply  with  the  Federal  system  requirements.  The  USMC  DDS 
files  did  not  account  for  all  the  commercial  and  miscellaneous  payments.  In  addition, 
DOD  funds  are  at  an  increase  risk  for  fraud,  waste,  and  abuse. 

Data  Reliability  Requirements 

The  Core  Financial  System  Requirements  state  that  audit  trails  are  essential  to  providing 
support  and  must  exist  for  recorded  transactions.  In  addition,  the  Government 
Accountability  Office  has  provided  guidance  related  to  accounting  systems  and  data 
reliability.  The  Government  Accountability  Office  Report  No.  GAO-03-273G, 
“Assessing  the  Reliability  of  Computer-Processed  Data,”  October  2002,  states  that  data 
are  reliable  when  they  are: 

•  complete  (they  contain  all  of  the  data  elements  and  records  needed  for  the 
engagement),  and 

•  accurate  (they  reflect  the  data  entered  at  the  source  or,  if  available,  in  the  source 
documents). 


19 


DOD  FMR  requires  that  DOD  Components,  including  the  USMC  and  DFAS,  maintain  a 
complete  and  documented  audit  trail.  Audit  trails  enable  the  tracing  of  a  transaction  from 
the  manual  vouchers  and  supporting  documentation  to  the  financial  statements.  This  is 
necessary  to  demonstrate  the  accuracy,  completeness,  and  timeliness  of  a  transaction. 

This  is  also  necessary  to  provide  documentary  support,  if  required,  for  all  data  generated 
by  the  USMC  and  submitted  to  the  DFAS  for  recording  in  the  accounting  systems  and 
use  in  financial  reports.  Agencies  should  ensure  they  code  each  charge  to  an 
appropriation  or  fund  with  a  complete  accounting  classification  and  country  code,  when 
applicable. 

DDS  Payment  Information 

The  USMC  financial  system,  which  includes  DDS,  did  not  capture  or  maintain  all  key 
payment  information  and  the  audit  trail  required  by  the  Core  Financial  System 
Requirements  for  185  of  200  vouchers  we  reviewed.  Specifically,  DDS  and  the  USMC 
financial  system  did  not: 

•  capture  the  name  of  the  individual  certifying  the  voucher  (91  vouchers), 

•  prevent  the  voucher  from  being  processed  and  paid  if  the  contract  or  requisition 
number  was  absent  (132  vouchers), 

•  accurately  capture  the  invoice  received  date  (103  vouchers),  and 

•  capture  the  invoice  number  for  check  or  cash  commercial  payments 
(35  vouchers). 

We  reviewed  a  statistical  sample  of  200  payment  vouchers  for  data  reliability  from  the 
consolidated  databases  of  9,675  disbursements  totaling  $310.4  million  provided  by  the 
DDS  PMO.^°  The  sample  included  160  commercial  and  40  miscellaneous  payments. 

DDS  was  the  initial  point  of  entry  into  the  USMC  financial  system  for  commercial  and 
miscellaneous  payments.  The  USMC  did  not  have  an  integrated  entitlement  system  to 
populate  key  payment  information  in  DDS.  As  a  result,  the  USMC  currently  processes 
commercial  and  miscellaneous  payment  information  into  DDS  manually.  Because  the 
USMC  relied  on  manual  input  of  key  commercial  and  miscellaneous  payment 
information  into  DDS,  its  financial  system  did  not  capture  or  maintain  key  payment 
information  and  the  audit  trail  required  by  the  Core  Financial  System  Requirements. 
USMC  personnel  stated  that  they  have  initiated  plans  to  use  an  entitlement  system,  the 
Computerized  Accounts  Payable  System,  which  will  interface  with  DDS  to  process 
commercial  and  miscellaneous  payment  transactions.  DFAS  should  enhance  DDS  to 
capture  and  maintain  key  payment  information  and  to  meet  the  audit  trail  requirements  in 
the  Core  Financial  System  Requirements. 


We  did  not  sample  the  arehived  transaetions  beeause  the  data  was  not  available  at  the  time  of  our  review. 
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Certifying  Officer  Name 

DDS  did  not  capture  the  name  of  the  individual  who  certified  91  of  the  200  sample 
vouehers  for  payment.  The  job  title  (for  example,  pay  agent)  of  the  individuals  who 
submitted  the  91  vouchers  for  eleetronie  certification  in  DDS  was  different  from  the 
individual’s  job  title  who  aetually  eertified  the  voueher  for  payment  with  a  handwritten 
signature.  The  signature  bloek  of  the  voueher^'  that  DDS  produees  reflects  the  “Title”  of 
the  DDS  user  who  reeorded  the  certifieation  in  the  system  while  the  handwritten 
signature  ineluded  in  the  signature  bloek  refieets  who  manually  eertified  the  payment. 
Aceording  to  DOD  FMR,  volume  5,  ehapter  33,  certifying  officers  are  peeuniarily  liable 
for  erroneous  payments  and  must  rely  on  the  efforts  of  others  who  support  the 
eertifieation  proeess.  Seetion  2773a,  title  10,  United  States  Code  holds  the  departmental 
accountable  offieials  pecuniarily  liable  for  illegal,  improper,  or  incorreet  payments 
resulting  from  the  negligent  provision  of  information,  data  or  services  to  certifying 
officials.  The  inability  to  identify  who  certified  the  voueher  prevents  the  USMC  from 
identifying  who  is  peeuniarily  liable  for  the  payment.  As  a  result,  DFAS  should  modify 
DDS  to  eapture  the  name  of  the  certifying  offieer  signing  the  vouehers  to  ensure  that 
DDS  refieets  the  aetual  certifier,  the  individual  who  is  peeuniarily  liable  for  the  payment. 

Contract  and  Requisition  Numbers 

The  DDS  data  for  132  of  the  160  commercial  pay  vouchers  in  our  sample  did  not  eontain 
a  contraet  or  requisition  number  in  the  eontraet  or  requisition  number  field.  The  contract 
and  requisition  numbers  were  available  in  the  supporting  doeumentation.  DDS  does  not 
require  the  user  to  populate  the  contract  or  requisition  number  field  for  commercial 
payments  to  complete  the  proeessing  of  the  data.  The  Core  Financial  System 
Requirements  state  that  the  eore  finaneial  system  must  provide  automated  functionality  to 
record  an  agency-assigned  souree  document  number,  which  may  be  a  eontraet  or 
requisition  number. 

DDS  currently  provides  the  field  to  record  a  contract  or  requisition  number;  however,  the 
users  do  not  populate  the  field  every  time  a  eommereial  pay  voueher  is  proeessed.  This 
reduees  the  adequaey  of  the  audit  trail.  In  order  for  the  USMC  to  maintain  an  adequate 
audit  trail,  DFAS  should  modify  DDS  to  require  the  user  to  populate  the  contraet  or 
requisition  number  field  before  they  can  process  a  eommereial  payment. 

invoice  Received  Date 

DDS  did  not  accurately  capture  the  invoiee-received  date  for  103  of  the  200  payment 
vouehers  reviewed.  The  Core  Financial  System  Requirements  state  that  adequate  internal 
eontrols  must  be  in  plaee  to  verify  that  the  USMC  ordered,  reeeived,  accepted,  and  paid 
for  goods  and  serviees  and  that  they  eomputed  proper  due  dates  and  payment  amounts. 

To  support  this  invoieing  process,  the  core  financial  system  must  provide  automated 
funetionality  to  capture  the  invoiee  reeeipt  date. 


*’  Standard  Form  1034,  Public  Voucher  for  Purchases  and  Services  Other  Than  Personal. 


21 


DDS  does  not  allow  the  user  to  proeess  the  voueher  unless  the  invoiee-reeeived  date 
is  populated.  However,  DDS  automatieally  pre-populates  the  invoiee  reeeived  date  field 
with  the  eurrent  business  date,  whieh  was  often  not  the  aetual  date  of  the  invoiee  reeeipt. 
Because  DDS  pre-populates  the  invoice-received  date,  the  system  relies  on  the  user 
to  manually  update  the  current  business  date  with  the  actual  commercial  payment 
invoice-received  date.  This  affects  the  ability  of  the  user  to  calculate  interest  or  discounts 
in  compliance  with  the  Prompt  Payment  Act.  DFAS  should  modify  DDS  so  the  system 
does  not  pre-populate  the  invoice  received  date  field  with  the  current  business  date  while 
maintaining  the  requirement  to  enter  an  invoice  received  date. 

Invoice  Number 

The  supporting  documentation  for  35  of  the  200  sample  vouchers  contained  invoice 
numbers;  however,  DDS  did  not  provide  the  capability  to  capture  these  invoice  numbers. 
DDS  currently  has  the  ability  to  capture  the  invoice  numbers  for  electronic  funds  transfer 
commercial  payments,  but  it  does  not  maintain  the  ability  to  capture  invoice  numbers  for 
check  or  cash  commercial  payments.  Additionally,  DDS  does  not  maintain  the  capability 
to  validate  for  duplicate  invoice  numbers  or  the  ability  to  query  on  the  invoice  number 
field.  The  Core  Financial  System  Requirements  state  that  the  core  financial  system  must 
provide  the  functionality  to  capture  the  invoice  number  and  the  functionality  to  validate 
for  duplicate  invoice  numbers  in  order  to  prevent  duplicate  payments.  The  inability  to 
capture  the  invoice  number  or  validate  for  duplicate  invoice  numbers  inhibits  users’ 
ability  to  query  the  vouchers  by  invoice  number,  limiting  the  audit  trail,  which  may  lead 
to  duplicate  payments  made  using  the  same  invoice.  For  example,  the  USMC  paid  an 
invoice  for  $735,600  on  January  14,  2007,  and  later  paid  that  same  invoice  again  on 
February  28,  2007.  Therefore,  DFAS  should  modify  DDS  to  capture  invoice  numbers  of 
check  and  cash  commercial  payments  and  the  ability  to  validate  for  duplicate  invoice 
numbers  for  electronic  funds  transfer,  check,  and  cash  commercial  payments. 

Line  of  Accounting 

The  USMC  did  not  ensure  DDS  captured  the  line  of  accounting  information  for  21  out  of 
9,675  disbursement  vouchers.  The  line  of  accounting  for  the  21  USMC  disbursement 
vouchers  did  not  reside  within  the  DDS  data,  and  the  line  of  accounting  did  not  appear  on 
the  DDS  generated  voucher.  This  occurred  because  of  a  delay  between  the  time  the  user 
entered  new  accounting  line  information  into  the  DDS  table  and  the  time  DDS  saved  the 
new  accounting  line  information  to  the  DDS  database.  The  supporting  documentation  for 
19  of  the  21  disbursement  vouchers  revealed  that  4  of  the  vouchers  contained  a 
handwritten  line  of  accounting  in  their  supporting  documentation. 

0MB  Circular  A- 127  requires  financial  management  systems  to  reflect  an  agency-wide 
financial  information  classification  structure  that  is  consistent  with  the  U.S.  Standard 
General  Ledger.  The  Core  Financial  System  Requirements  state  that  the  core  financial 
system  must  provide  automated  functionality  to  maintain  an  accounting  classification 
structure  that  includes  the  treasury  account  symbol;  budget  fiscal  year;  internal  fund 
code;  organization;  program;  project;  activity;  cost  center;  object  class;  revenue  source; 
budget  function;  budget  sub-function  code;  and  the  accounting  period.  In  addition,  DOD 
FMR,  volume  5,  chapter  11,  states  that  agencies  should  ensure  they  code  each  charge  to 
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an  appropriation  or  fund  with  a  complete  aceounting  elassification  and  country  code, 
when  applicable.  If  the  space  available  for  the  accounting  classification  data  is 
insufficient,  then  list  the  information  on  a  continuation  form. 

We  informed  the  DDS  PMO  that  DDS  generated  vouchers  without  a  line  of  accounting. 
The  DDS  PMO  demonstrated  that  they  fixed  this  problem  in  version  3.3  of  the 
application,  which  USMC  implemented  at  Camps  Pendleton,  Lejeune,  and  Foster 
September  through  November  2008.  As  a  result,  we  are  not  making  a  reeommendation 
addressing  this  issue. 

Centralized  Database 

The  USMC  did  not  have  a  centralized  database  to  maintain  all  DDS  transaetions  and  to 
ensure  the  completeness  of  DDS  data.  DDS  did  not  maintain  complete  records  of  all 
disbursement  transaetions  beeause  the  DDS  archive  process  did  not  capture  key 
information  required  by  the  Core  Financial  System  Requirements.  DFAS  developed 
DDS  to  operate  as  a  standalone  application;  the  USMC  maintained  separate  databases  for 
eaeh  disbursing  site.  As  a  result,  DDS  PMO  and  USMC  personnel  could  not  provide,  in 
a  timely  manner,  a  complete  set  of  DDS  data  for  this  audit. 

DDS  Databases 

The  USMC  financial  system  did  not  maintain  a  complete  set  of  DDS  data.  The  DDS 
PMO  and  the  USMC  personnel  did  not  immediately  provide  us  the  FYs  2006  and  2007 
DDS  databases.  We  initially  requested  these  databases  in  October  2007  and  did  not 
receive  our  total  universe  of  DDS  data  for  9,675  vouchers  until  March  2008.  We  tested 
completeness  of  the  FYs  2006  and  2007  DDS  databases  and  identified  that  at  least 
14,003  USMC  vouchers  were  missing  from  the  DDS  data  originally  provided.  In 
Oetober  2008,  we  notified  the  DDS  PMO  of  the  missing  vouchers;  personnel  provided 
archived  files  containing  only  13,197  vouchers,  totaling  $209.6  million.  The  DDS  PMO 
did  not  provide  DDS  data  for  the  remaining  806  USMC  disbursement  vouchers  and  could 
not  provide  an  explanation  of  what  happened  to  the  data  for  these  vouehers.  The  USMC 
should  eoordinate  with  the  DDS  PMO  in  locating  the  missing  DDS  data  for  these 
806  vouchers.  If  the  USMC  cannot  locate  the  missing  data,  they  should  research  the 
vouchers  and  reconstruet  the  DDS  data. 

Archived  Data 

The  DDS  archive  process  did  not  capture  key  information  required  by  the  Core  Financial 
System  Requirements.  The  Core  Financial  System  Requirements  state  that  core  financial 
systems  must  provide  the  functionality  to  capture  all  doeument  changes,  ineluding  the 
date,  time,  and  user  identifieation  to  support  the  audit  trail.  However,  the  DDS  voucher 
arehive  process  only  eaptures  the  title  and  not  the  name  of  the  user  that  certified  each 
disbursement  for  payment.  As  a  result,  the  DDS  voucher  archive  process  did  not 


This  refers  only  to  the  archiving  process  of  “Standard  Form  1034.  Public  Voucher  for  Purchases  and 
Services  Other  Than  Personal.” 
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maintain  an  audit  trail  to  identify  the  individuals  who  paid  or  certified  12,873  of  the 
13,197  archived  disbursements  in  FYs  2006  and  2007.  The  identity  of  the  individuals 
who  paid  or  certified  the  disbursement  is  critical  for  payment  accountability.  The  DDS 
PMO  should  update  the  archive  process  to  capture  this  key  information. 

The  USMC  and  DFAS  should  develop  and  maintain  a  centralized  database  of  the 
transactions  processed  through  the  Deployable  Disbursing  System.  A  centralized 
database  would  provide  useful  information  for  USMC  financial  managers  to  better 
manage  and  evaluate  disbursing  operations,  and  better  provide  oversight  on  how  the 
USMC  uses  funds.  USMC  financial  managers  could  also  evaluate  the  centralized 
database  by  using  data  mining  tools  to  identify  the  improper  payments  and  user  access 
issues  presented  in  this  report. 

Conclusion 

USMC  audit  trails  for  commercial  and  miscellaneous  payment  data  processed  through 
DDS  are  inadequate,  and  DDS  did  not  comply  with  the  financial  system  requirements  in 
the  Federal  Financial  Management  Improvement  Act  of  1996.  The  USMC  and  DFAS 
should  improve  the  accuracy  and  completeness  of  USMC  commercial  and  miscellaneous 
payment  data  processed  through  DDS.  DFAS  should  modify  DDS  to  require  the  input  of 
key  payment  information  and  capture  key  data  elements  in  the  archiving  process.  In 
addition,  the  USMC  and  DFAS  should  develop  and  maintain  a  centralized  database  of  the 
transactions  processed  through  DDS.  Without  complete  and  accurate  data  and  a 
transparent  audit  trail,  DOD  funds  are  at  an  increased  risk  for  fraud,  waste,  and  abuse. 

Revised  Recommendation 

In  response  to  recommendation  B.l.a,  DFAS  worked  with  the  USMC  in  locating  and 
providing  the  missing  transactions  to  the  audit  team.  As  a  result  of  reconciling  the 
information  provided  by  USMC  and  DFAS  to  our  original  list  of  missing  vouchers,  we 
concluded  that  the  original  number  of  missing  vouchers  should  have  been  806  and  not  the 
815  presented  in  the  draft  report.  We  revised  the  numbers  in  the  finding  and  in 
recommendation  B.l.a  accordingly. 

Recommendations,  Management  Comments,  and  our 
Response 

B,l.  We  recommend  that  the  Assistant  Deputy  Commandant,  Programs  and 
Resources  Department;  and  Fiscal  Director  of  the  United  States  Marine  Corps,  in 
coordination  with  the  Director,  Defense  Finance  and  Accounting  Service: 

a.  Locate  the  missing  Deployable  Disbursing  System  data  for  the  806  United 
States  Marine  Corps’  disbursement  vouchers  not  provided  by  the  Deployable 
Disbursing  System  Program  Management  Office,  If  they  are  unable  to  locate 


Of  the  13,197  disbursements,  12,873  used  Standard  Form  1034;  320  were  manual  disbursements; 
and  4  used  Standard  Form  44,  “Purchase  Order- Invoice- Voucher.” 
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these  missing  data,  the  United  States  Marine  Corps  should  research  the 
vouchers  and  reconstruct  the  Deployable  Disbursing  System  data. 

Department  of  the  Navy  and  Defense  Finance  and  Accounting 
Service  Comments 

The  Assistant  Secretary  of  the  Navy  (Financial  Management  and  Comptroller)  (Acting), 
and  the  Director,  DFAS  Information  and  Technology,  agreed.  DFAS  worked  with  the 
USMC  in  locating  and  providing  the  audit  team  with  the  missing  transactions. 

Our  Response 

Comments  from  the  Assistant  Secretary  of  the  Navy  (Financial  Management  and 
Comptroller)  (Acting)  and  the  Director,  DFAS  Information  and  Technology,  are 
responsive  to  the  recommendations  and  no  additional  comments  are  required.  We 
received  the  missing  vouchers  from  the  DDS  PMO  on  October  21,  2009. 

b.  Develop  and  maintain  a  centralized  database  of  the  transactions  processed 
through  the  Deployable  Disbursing  System, 

Department  of  the  Navy  and  Defense  Finance  and  Accounting 
Service  Comments 

The  Assistant  Secretary  of  the  Navy  (Financial  Management  and  Comptroller)  (Acting) 
and  the  Director,  DFAS  Information  and  Technology,  agreed.  They  stated  that  DFAS  has 
completed  development  of  a  centralized  repository  that  should  be  operational  in 
November  2009. 

Our  Response 

Comments  from  the  Assistant  Secretary  of  the  Navy  (Financial  Management  and 
Comptroller)  (Acting)  and  the  Director,  DFAS  Information  and  Technology,  are 
responsive  and  no  additional  comments  are  required.  On  November  5,  2009,  we  met 
with  the  DDS  PMO  and  verified  that  they  have  completed  the  centralized  repository. 

B,2,  We  recommend  that  the  Director,  Defense  Finance  and  Accounting  Service, 
establish  a  time-phased  plan  to  modify  the  Deployable  Disbursing  System  to: 

a.  Capture  the  name  of  the  certifying  officer  signing  the  vouchers  to  reflect  the 
actual  certifier, 

b.  Require  users  to  enter  the  contract  number  or  requisition  number  for 
commercial  payments, 

c.  Eliminate  the  pre-population  of  the  invoice  received  date  field  with  the 
current  business  date  while  maintaining  the  requirement  to  enter  an  invoice 
received  date. 
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d.  Capture  the  invoice  number(s)  for  commercial  payments  and  maintain  the 
ability  to  validate  for  duplicate  invoice  numbers, 

e.  Capture,  within  the  archive  data,  the  identity  of  an  individual  who  pays  or 
certifies  a  voucher. 

Defense  Finance  and  Accounting  Service  Comments 

The  Director,  DFAS  Information  and  Technology,  agreed.  DFAS  has  written  System 
Change  requests  and  will  submit  them  to  the  Strategic  Disbursing  Initiative  Change 
Control  Board  in  January  2010. 

Our  Response 

Comments  from  the  Director,  DFAS  Information  and  Technology,  are  responsive  and  no 
additional  comments  are  required. 
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Finding  C.  Recording  Obligations 

The  USMC  timely^"^  and  sufficiently  recorded  $6.3  million  in  obligations  for 
150  commercial  and  miscellaneous  payments  processed  in  the  DDS  databases.  We  did 
not  review  the  obligations  for  the  disbursements  that  USMC  had  archived  because  the 
information  was  not  available  at  the  time  of  our  test. 

Obligation  Requirements 

DOD  FMR,  volume  10,  chapter  1,  requires  that  a  planned  disbursement  match  a  recorded 
obligation  before  DOD  personnel  make  the  payment.  The  requirement  is  in  place  for 
personnel  to  determine  if  an  obligation  is  sufficient  to  cover  the  planned  disbursement. 
However,  DOD  FMR,  volume  3,  chapter  8,  recognizes  that  on  occasion  personnel  can 
make  a  disbursement  without  the  related  obligation  having  been  recorded  previously  by 
allowing  the  obligation  and  the  payment  to  be  recorded  simultaneously.  In  general,  DOD 
personnel  should  not  disburse  funds  if  they  have  not  been  legally  obligated.  The  timely 
and  accurate  recording  of  obligations  facilitates  the  disbursing  officer’s  ability  to  verily 
fund  availability  before  authorizing  a  payment. 

Voucher  Analysis 

The  USMC  timely  and  sufficiently  recorded  obligations  for  commercial  and 
miscellaneous  payments  processed  in  the  DDS  FYs  2006  and  2007  databases.  We 
reviewed  obligations  related  to  150  vouchers,  totaling  $6.3  million,  out  of  the  200 
randomly  sampled  vouchers.  We  used  the  standard  document  number  from  the  DDS 
voucher  line  of  accounting  as  the  unique  identifier  to  locate  the  related  obligation  records 
in  the  SABRS.  We  analyzed  each  DDS  voucher  to  determine  whether  an  obligation 
amount  greater  than  or  equal  to  the  payment  amount  that  USMC  recorded  in  SABRS  was 
obligated  in  accordance  with  regulations. 

We  did  not  review  obligations  for  the  remaining  50  sample  vouchers  totaling  $0.7  million 
because  there  was  no  matching  obligation  recorded  in  SABRS  or  the  voucher  was  outside 
the  scope  of  the  audit.  The  obligation  information  was  not  in  SABRS  or  not  reviewed  for 
justifiable  reasons. 

•  Of  the  50  vouchers,  27  vouchers  contained  disbursements  against  Army  and 
Defense  appropriations.  These  payments  were  not  against  allocations  received 
and  executed  by  the  USMC.  As  a  result,  the  USMC  did  not  record  an  obligation 
in  SABRS. 


An  obligation  is  reported  “timely”  if  the  obligation  date  was  reeorded  in  the  aeeounting  system  on  or 
before  the  DDS  disbursement  date. 
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•  The  USMC  and  DFAS  personnel  indicated  that  16  of  the  50  vouchers  related  to 
military  payments.  We  did  not  review  the  obligations  associated  with  these 
military  pay  related  disbursements  because  the  audit  scope  was  limited  to 
commercial  and  miscellaneous  payment  vouchers. 

•  Of  the  50  vouchers,  7  were  for  miscellaneous  payments  posted  to  a  budget 
clearing  account  (suspense).  Because  the  USMC  does  not  record  budget 
clearing  account  transactions  in  SABRS,  we  could  not  match  these  transactions 
to  obligations  in  SABRS. 

Because  the  USMC  timely  and  sufficiently  recorded  the  obligations  in  SABRS  for  the 
150  disbursements  in  our  sample  of  DDS  vouchers,  we  are  not  making  any 
rec  ommendations . 
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Appendix  A.  Scope  and  Methodology 

We  conducted  this  performance  audit  from  May  2008  through  September  2009  in 
accordance  with  generally  accepted  government  auditing  standards.  Those  standards 
require  that  we  plan  and  perform  the  audit  to  obtain  sufficient,  appropriate  evidence  to 
provide  a  reasonable  basis  for  our  findings  and  conclusions  based  on  our  audit  objectives. 

In  FYs  2006  and  2007,  the  USMC  processed  through  DDS  more  than  22,872  commercial 
(contract  and  vendor  payments)  and  miscellaneous  payment  vouchers  totaling  at  least 
$520  million.  We  received  complete  DDS  data  for  9,675  vouchers.  We  received 
archived  data  for  an  additional  13,197  commercial  and  miscellaneous  USMC  DDS 
payments.  We  could  not  review  these  archived  vouchers  because  we  did  not  receive  the 
archived  DDS  data  in  time  for  our  review  and  because  DDS  does  not  capture  certain  key 
data  elements  in  the  archived  files.  In  addition,  the  DDS  PMO  could  not  provide  DDS 
data  for  806  USMC  disbursement  vouchers.  Therefore,  this  was  a  scope  limitation.  We 
believe  that  the  evidence  obtained  provides  a  reasonable  basis  for  our  findings  and 
conclusions  based  on  our  audit  objectives. 

From  the  DDS  databases  the  DDS  PMO  originally  provided,  we  obtained  a  universe  for 
FY  2006  and  FY  2007  USMC  vouchers,  which  totaled  9,675  vouchers  valued  at 
$310.4  million.  We  selected  a  statistical  sample  from  this  universe.  The  universe 
included  commercial  and  miscellaneous  payment  vouchers  from  the  three  USMC 
disbursing  stations:  Camp  Pendleton,  California;  Camp  Lejeune,  North  Carolina;  and 
Camp  Foster,  Okinawa,  Japan.  Our  statistical  sample  approach  resulted  in  the  selection 
of  200  vouchers. 

The  table  shows  a  break  out  of  the  vouchers  by  location.  We  tested  the  reliability  of  DDS 
payment  information  by  comparing  200  hard  copy  vouchers  and  supporting 
documentation  to  the  DDS  data.  In  addition,  we  reviewed  USMC  obligations  related  to 
$6.3  million  of  disbursement  vouchers  from  150  of  the  200  randomly  sampled  vouchers. 
The  other  50  vouchers  were  outside  the  scope  of  the  audit,  as  discussed  in  Finding  C. 


Statistical  Sample  of  USMC  Payment  Vouchers 


Location 

Number  of  Vouchers 

Amount 

Camp  Lejeune 

161 

$4,528,123 

Camp  Foster 

12 

15,039 

Camp  Pendleton 

27 

2,519,789 

Total 

200 

$7,062,951 
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We  analyzed  the  seleeted  payment  vouehers  to  determine  whether  internal  eontrols  over 
transactions  processed  through  the  DDS  are  adequate  to  ensure  the  reliability  of  the  data 
processed.  We  completed  a  review  of  the  sample  vouchers  to  determine  if  key  data 
elements  such  as  certifying  official  information,  contract  and  requisition  numbers, 
invoice  received  date,  and  invoice  number  were  complete  and  accurate. 

We  compared  the  universe  of  DDS  data  to  data  from  SABRS  to  verify  that  all  the  DDS 
data  matched  to  data  within  SABRS  and  that  the  data  was  complete  and  accurate. 

Use  of  Computer  Processed  Data 

We  relied  upon  computer-processed  data  obtained  from  DDS  and  SABRS  to  perform  this 
audit.  We  performed  a  reliability  assessment  for  computer-processed  data  out  of  DDS. 

As  discussed  in  Findings  A  and  B  of  this  report,  we  found  DDS  control  weaknesses  and 
data  discrepancies,  in  that  the  USMC  DDS  data  was  incomplete  and  inaccurate.  We 
assessed  the  reliability  of  SABRS  data  by  comparing  the  line  of  accounting  from 
hardcopy  vouchers  and  DDS  data  to  SABRS  data.  As  discussed  in  Finding  C,  we  did  not 
find  discrepancies  in  the  reliability  of  the  data.  We  assessed  the  reliability  of  EDA/VPS, 
a  document  repository,  by  comparing  the  hardcopy  vouchers  and  supporting 
documentation  in  EDAWPS  to  the  DDS  data.  We  did  not  find  discrepancies  in  the 
reliability  of  the  EDA/VPS  data.  As  a  result,  we  found  the  SABRS  and  EDAWPS  data 
sufficiently  reliable  for  our  purposes. 

Use  of  Technical  Assistance 

The  Quantitative  Methods  and  Analysis  Division,  Quantitative  Methods  Branch, 
provided  technical  assistance  throughout  the  sample  selection.  The  Quantitative  Methods 
Branch  provided  a  sample  of  disbursements  from  the  DDS  to  test  for  reliability. 

The  Quantitative  Methods  and  Analysis  Division,  Data  Mining  Branch,  consolidated  the 
DDS  databases  provided  by  the  DDS  PMO  into  the  data  mining  program  for  the  audit 
team  to  analyze. 

Prior  Coverage 

During  the  last  5  years,  the  Department  of  Defense  Inspector  General  (DOD  IG) 
and  the  Army  Audit  Agency  (AAA)  have  issued  five  reports  discussing  the 
Deployable  Disbursing  System.  One  can  access  unrestricted  DOD  IG  reports  at 
http://www.dodig.mil/audit/reports.  One  can  access  unrestricted  AAA  reports 
at  https://www.aaa.armv.mil/. 

DOD  IG 

DOD  IG  Report  No.  D-2009-054,  “Identification  of  Classified  Information  in 
Unclassified  DOD  Systems  During  the  Audit  of  Internal  Controls  and  Data  Reliability  in 
the  Deployable  Disbursing  System,”  Eebruary  17,  2009 

DOD  IG  Report  No.  D-2009-003,  “Internal  Controls  Over  Army  General  Eund,  Cash  and 
Other  Monetary  Assets  Held  Outside  of  the  Continental  United  States,”  October  9,  2008 
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DOD  IG  Report  No.  D-2008-098,  “Internal  Controls  Over  Payments  Made  in  Iraq, 
Kuwait,  and  Egypt,”  May  22,  2008 

DOD  IG  Report  No.  D-2008-040,  "Defense  Retiree  and  Annuitant  Pay  System  and 
Deployable  Disbursing  System  Complianee  with  the  Defense  Business  Transformation 
System  Certifieation  Criteria,"  January  4,  2008 

Army 

AAA  Report:  A-2003-0360-FFG,  “Validation  of  the  Deployable  Disbursing  System  - 
Defense  Finance  and  Accounting  Service,"  July  21,  2003 
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Appendix  B.  USMC  Disbursement  Cycle 

USMC  Procurement  and  Disbursing  Processes 


The  USMC  procurement  and  disbursing  process  begins  with  the  entry  of  purchase  data 
into  the  procurement  system  and  culminates  with  a  payment  out  of  DDS.  See  the 
flowchart  of  this  process  on  the  next  page.  The  requestor  enters  a  procurement  request 
into  the  USMC  in-theater  procurement  system.  Upon  approval  of  the  request,  the  Marine 
Expeditionary  Force  Comptroller’s  Office  commits  funding  in  the  SABRS.  The 
Comptroller  Office  then  routes  the  commitment  to  the  contracting  manager  who  will  then 
award  a  contract.  The  contracting  manager  enters  the  contract  information  into  the 
procurement  system  and  routes  the  information  back  to  the  Comptroller’s  Office  to 
obligate  funds  in  SABRS.  The  vendor  provides  the  goods  or  services  and  submits  an 
invoice.  The  receiving  official  acknowledges  receipt  of  goods  or  services  on  the 
receiving  report.  The  payment  cell^  prepares  a  payment  package,  which  includes  the 
vendor  invoice,  receiving  report,  and  contract.  The  payment  cell  submits  the  payment 
package  to  the  Comptroller’s  Office  so  the  payment  can  be  pre-validated.  Finally,  the 
Comptroller’s  Office  submits  the  payment  package  to  the  certifying  officer  for  review 
and  certification.  Once  the  certifier  approves  the  payment  package,  the  disbursing  office 
can  make  the  payment. 

The  disbursing  office  uses  DDS  to  process  manual  SF  1034,  Public  Voucher  for 
Purchases  and  Services  Other  Than  Personal,  vouchers  from  deployed  disbursing  agents. 
The  disbursing  office  makes  payments  using  DDS  by  cash,  check,  or  electronic  funds 
transfer.  The  disbursing  office  enters  the  payment  data  into  DDS  and  scans  the 
supporting  documentation  into  the  EDAA^PS  for  record  retention.  DDS  interfaces  with 
EDA/VPS  to  provide  an  electronic  copy  of  the  voucher  data.  Then  EDAA^PS  matches 
the  voucher  data  with  the  appropriate  supporting  documentation. 

In  addition  to  providing  transaction  data  to  EDAA^PS,  DDS  provides  transaction  data  to 
the  Expenditures  and  Collections  and  the  Treasury  system  through  an  interface.  The 
Expenditures  and  Collections  system  forwards  transactional  data  through  an  interface  to 
the  Defense  Cash  Accountability  System.  The  Defense  Cash  Accountability  System 
interfaces  with  the  Treasury  system  and  SABRS.  SABRS  then  provides  trial  balance  data 
to  the  Defense  Departmental  Reporting  System  for  creation  of  budgetary  reports,  using 
the  Budgetary  Module,  and  the  USMC  financial  statements,  using  the  Audited  Financial 
Statements  Module. 


*  The  payment  eell,  housed  in  the  eontraeting  offiee,  eolleets  the  eontraet  modifieation  doeuments,  eontraet, 
eheeklist,  invoiee,  and  DD  Form  250,  Material  Inspeetion  and  Reeeiving  Report,  for  preparation  of  the 
payment  paekage. 
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USMC  Flow  of  DDS  Disbursement  Transactions 


Manual  Voucher 
and/or  Supporting 
Documentation 


Transaction  Data 


Transaction  Data 


Manual  Scan  & 
Upload  of 
Supporting 
Documentation 


Transaction 

Data 


Transaction 

Data 


Expenditures  & 
Collections 


Transaction 

Data 


Transaction  Data 


Defense  Cash 
Accountability 


Transaction 

Data 


Trial 

Balance 


DDRS-B 


Trial 

Balance 


USMC  Financial 
Statements 


DDRS-AFS 


^  Defense  Departmental  Reporting  System-Budgetary  (DDRS-B); 

Defense  Departmental  Reporting  System-Audited  Financial  Statements  (DDRS-AFS) 
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Appendix 

Benefits 

Recommendation 

Reference 


A.1.d 


C.  Summary  of  Potential  Monetary 


Amount  of 

Type  of  Benefit _ Benefit _ Account 

Economy  and 
Efficiency.  The 
Government  could 
better  use  these 
funds  for  needed 
projects.  $2.5  million 

$0.2  million  from 
Operations  and 
Maintenance,  Army 


$2.3  million  from 
Operations  and 
Maintenance, 
Marine  Corps 
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Department  of  the  Navy  Comments 


THE  ASSISTANT  SECRETARY  OF  THE  NAVY 

{FINANCIAL  MANAGEMENT  AND  COMPTflOaER) 
1000  NAVY  PENTAGON 
WASHINGTON  DC  20350-1000 


October  22 »  2009 


MEMORANDUM  FOR  INSPECTOR  GENERAL,  DEPARTMENT  OF  DEFENSE 


SUBJECT;  DoDIG  Draft  Report,  “Internal  Controls  Over  U.S.  Marine  Corps 

Commercial  and  Miscellaneous  Payments  Processed  Through  the  Deployable 
Disbursing  System”,  Dated  22  September  2009  (Project  No.  D2(X)7-D0(X)FL- 
0252.001) 


The  attached  is  the  coordinated  Department  of  the  Navy  response  to  Department 
of  Defense  (DoD)  Inspector  General  (DOD  IG)  letter  of  September  22,  2009  of  the  same 
subject.  The  response  addresses  the  recommendations  made  in  the  draft  report. 


My  point  of  contact  for  any  questions  on  this  issue  is 


^  John  W.  McNair 
Acting 


Attachments: 
As  stated 


cc: 

CMC 
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DODICi  DRAI'T  RKPORT  DATED  22  SEPTEMBICR  2009 
Project  No.  D2OO7-D0OOFL-O252.OO1 

“Inlenial  Controls  OverU.S.  Marine  Corps  Commercial  and  Miscellaneous  Payments 
Processed  Tlirough  the  Deployable  Disbursing  System'* 

DEPAR  I  MENT  OF  THE  NAVY  COMMENTS 
TO  THE  DODIG  RECOMMENDATIONS 


RKC!0\rVtK\DATI0\  A.l,;  Wc  recommend  that  the  Assistant  Deputy  Commandant,  Programs  and 
Resources  Department;  and  Fiscal  Director  of  the  United  States  Marine  Corps; 

a.  Develop  and  implement  procedures  to: 

1)  Eliminate  the  use  of  multiple  user  accounts  in  the  Deployable  Disbursing  System  and  require 
justification  for  rare  circumstances  when  multiple  users  are  necessary 

2)  Minimize  the  number  of  users  with  the  system  administrator  privilege. 

3)  Review  Deployable  Disbursing  System  user’s  access,  including  the  use  of  multiple  and  generic 
user  accounts  and  system  admini.strator  privilege,  to  ensure  separation  of  duties. 

4)  Conduct  periodic  reviews  of  Deployable  Disbursing  System  data  to  identify  anomalies,  which 
could  indicate  potential  illegal  and  improper  payments.  When  warranted,  the  United  States 
Marine  Corps  should  initiate  collection  procedures  on  identified  improper  payments. 

b.  Perform  reviews  of  Deployable  Disbursing  System  procedures  implemented  m  Recommendations 
A.  I  , a,  1-4  during  periodic  reviews  ofdisbursir^  offices. 

c.  Review  the  transactions  processed  using  multiple  and  generic  user  accounts  to  ensure  the  payments 
were  proper.  The  United  States  Marine  Corps  should  initiate  administrative  action  against  the  responsible 
Deployable  Disbursing  System  user  if  they  identify  improper  payments  associated  with  the  multiple  and 
generic  user  accounts. 

d.  Review  the  Deployable  Disbursing  System  payments  for  FY  2006  and  FY  2007  for  duplicate 
payments  and  collect  the  over  payments, 

DON  RKSI*0.\SK 

a.  1 .  Concur.  Policy  memorandum  was  issued  and  implemented  on  September  8,  2008,  to  eliminate 
multiple  user  accounts  in  the  Deployable  Disbursing  System  and  to  require  justification  for  rare 
circumstances  when  multiple  users  may  be  necessary.  Validation  of  compliance  was  conducted  by  the 
Marine  Corps  Disbursing  Operations  and  System  Section  (MCDOSS)  and  all  offices  are  now  in 
compliance.  Proof  of  compliance  provided  to  the  DODIG  on  July  1 5,  2009. 

a.2.  Concur.  Policy  memorandum  was  issued  and  implemented  on  September  8,  2008,  to  restrict  system 
administrator  privileges  in  the  Deployable  Disbursing  System  to  individuals  not  assigned  any  duties  or 
other  assigned  roles  within  the  sj'stem.  Validation  of  compliance  was  conducted  by  MCDOSS  and  ail 
ofl’iccs  arc  in  compliance.  Proof  of  compliance  provided  to  the  DODIG  on  July  1 5. 2009. 

a.3.  Concur.  Policy  memorandum  was  issued  and  implemented  on  September  8,  2008,  to  eliminate  all 
gencnc  user  accounts  and  system  administrator  privileges,  and  to  ensure  separation  of  duties.  Validation 
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of  compliance  was  conducted  by  MCDOSS  and  all  offices  arc  now  in  compliance.  Proof  of  compliance 
provided  to  the  DODIG  on  July  15,  2009. 

a  4.  Concur.  The  Deployable  Disbureing  System  data  is  reviewed  remotely  by  MCDOSS  on  a  monthly 
basis  to  identify  potential  anomalies  which  could  indicate  illegal  and  improper  payments.  MCDOSS  also 
conducts  annual  on-site  reviews  of  DDS  data.  Additionally,  formal  unannounced  inspections  are 
conducted  annually  by  the  Marine  Corps  Administrative  Analysis  Team  (MCAAT).  All  reviews  and 
inspections  are  conducted  to  identity  anomalies  which  could  indicate  illegal  and  improper  payments  and 
when  warranted,  corrective  action  is  initialed. 

b.  Concur.  Offices  arc  required  by  regulation  and  USMC  policy  to  conduct  inlcmat  assessments  of  their 
own  compliance  regarding  DDS  profiles  and  access  every  60  days.  This  self-inspection  is  a  normal 
procedure  required  for  all  disbursing  system  profiles  and  accesses.  MCDOSS  also  conducts  annual 
informal  on-site  reviews  to  ensure  offices  are  in  compliance.  Additionally,  formal  unannounced  inspections 
are  ccwiducted  annually  by  MCAAT.  All  reviews  and  inspections  are  conducted  to  ensure  compliance  with 
regulations  and  USMC  Policy  memorandums. 

c.  Concur.  Reviews  of  transactions  processed  using  multiple  and  generic  aser  accounts  were  conducted  by 
MCDOSS  monthly  remote  reviews  and  annual  on-site  reviews.  There  was  no  need  for  administrative 
action  against  the  responsible  Deployable  Disbursing  System  user,  because  there  weren't  any  identified 
improper  payments  associated  with  the  multiple  and  generic  user  accounts. 

The  United  States  Marine  Corps  should  initiate  if  they  identify. 

d.  Concur,  Reviews  were  conducted  as  part  of  MCDOSS  monthly  remote  reviews  and  annual  on-site 
reviews.  Of  the  32  duplicate  pa>Tnents  identified  by  the  DODIG.  the  following  corrective  action  has  been 
taken; 

18  -  Have  been  resolved  via  collection  or  reduced  PV; 

6  -  Will  be  resolved  via  collection  voucher  on  October  1 5,  2009; 

8  -  Remain  outstanding  Demand  letters  were  submitted  to  the  vendors  on  July  7,  2009. 

RECOMMENDATION  B.I.:  We  recommend  that  the  Assistant  Deputy  Commandant.  Programs  and 
Resources  Department;  and  Fiscal  Director  of  the  United  Slates  Marine  Corps,  in  coordination  with 
the  Director.  Defense  Finance  and  Accounting  Service: 

a.  Locate  the  missing  Deployable  Disbursing  System  data  for  the  815  United  States  Marine  Corps* 
disbursement  transactions  not  provided  by  the  IJeployable  Disbursing  System  Program  Management 
OlTicc.  If  they  arc  unable  to  locate  these  missing  transactions,  the  United  States  Marine  Corps  should 
research  the  transactions  and  reconstruct  the  Deployable  Disbursing  System  data 

b.  Develop  and  maintain  a  centralized  database  of  the  transactions  (^ocessed  through  the  Deployable 
Disbursing  System. 

DON  RKSI^O.NSE 

a.  Concur.  MCDOSS  and  DDS  PMO  have  worked  together  to  locate  659  of  the  815  missing  transactions 
in  DDS.  The  remaining  156  documents  have  been  located  and  all  data  will  be  provided  to  the  DODIG 
team 

b.  Concur.  The  DDS  PMO  completed  development  of  the  central  repository'  and  it  should  be  operational  in 
November  2009. 
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Defense  Finance  and  Accounting  Service  Comments 


DEFENSE  FINANCE  AND  ACCOUNTING  SERVICE 


ARUNGTON 

1851  SOUTH  BELL  STREET 
ARLINGTON.  VA  22240-5291 


OCT  2  6  2009 


DFAS-HT 


MEMORANDUM  FOR  INSPECTOR  GENERAL,  DEPARTMENT  OF  DEFENSE 

SUBJECT:^  Management  Comments  for  DoD  IG  Draft  Report,  Project  No.  D2007-D000FL- 
0252.001,  "Internal  Controls  Over  U.S.  Marine  Corps  Commercial  and  Miscellaneous  Payments 
Processed  Through  the  Deployable  Disbursing  System  (DDS).” 

Attached  is  updated  management  comments  for  subject  audit;  recommendations  A  2 
B.l.andB.2.  '  ’ 


)f  Contact  (POC)  for  these  recommendations  is  DFAS-HTSCB 


Jerry  Sl.  Hinton 

Director,  Information  and  Technology 
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i|cnON  MEMO 

TO;  UlRECTOR,  INFORMATION  ANp  TECHNOLOGY 

THRU:  DEPUTY  DIRECTOR,  INFORMATION  ANp  TECHNOLOGY 

FROM:  DIRECTOR,  SYSTEMS  MAnI^GEMENT 

SUBJECT:  Management  Comments  forlOoD  IG  Draft  Report,  Project  No.  D2007-DO0OFL- 
0252.001 ,  Internal  Controls  Over  U.S.  Marine  Corps  Commercial  and  Misccllaneoi.s  Payments 
Processed  Through  the  Deployable  Disbtkrsing  System  (DDS).” 

PURPOSE:  To  provide  management  cotpments  for  subject  audit  report  recommendations  A  2 
B.l  and  B.2 


Recommendation  A. 2  recommends  d 
enhance  visibility  over  user  roles  and 
requests  are  written  and  being  impac: 
completion  date  to  be  detenliined  by 


welopment  of  three  system  improvements  whieh  would 
system  administrator  functions.  System  Change 
lied..  Acceptance  of  requirements  and  scheduled 
he  SDI CCB  expected  to  meet  in  January  2010. 


•  Recommendation  B.  I  recommends  trie  Assistant  Deputy  Commandant,  Programs  and 
Resources.  Fiscal  Director,  United  SiWes  Marine  Corps  coordinate  with  Director.  Defense 
Finance  and  Accounting  Service  to  l<^te  missing  data  for  8 1 5  disbursing  transactions.  In 
addition,  it  is  recommended  the  DD^PMO  develop  and  maintain  a  centralized  database  of 
alMransactions  processed  through  DDS.  The  DDS  PMO  and  Marine  Corps  Disbursing 

Systems  Support (MCDOSS)  have  worked  together  to  locate  6S9of  the  813  missing 
DDS  transactions.  The  remaining  156  documents  have  been  located  and  all  data  will  be 
pmvided  to  the  DoDIO  team.  The  DpS  PMO  completed  development  of  the  central 
repository  and  h  should  be  operational  in  November  2009 


Recommendation  B.2  recommended  DFAS  establish  a  lime-phased  plan  to  modify  DDS  with 
live  system  enhancements  to  soengthpi  DDS  internal  controls  and  data  reliability.  System 
hange  requests  are  written  and  beini  impacted.  Acceptance  of  requirements  and  scheduled 
compleuon  date  to  be  delermined  by  ^  SDI  CCB  expected  to  meet  in  January  2010. 


RECOMMENDATION:  Director.  Infonfiation  and  Technology  sign  the  memorandum. 


COORDINATION: 

Attachment: 

As  Staled 


_Ditoctor,  Accounting  Systems 


Prepared  By: 


s,DFAS-HTS4b,| 
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Management  Comments  for  DoD  IG  Draft  Report,  Project  No.  D2007-D000FL-0252.001, 
"Internal  Controls  Over  U.S.  Marine  Corps  Commercial  and  Miscellaneous  Payments 
Processed  Through  the  Deployable  Disbursing  System  (DDS).” 

Recommendation  A.2  :  Wc  recommend  that  the  Director,  Defense  Finance  and  Accounting 

Service: 

a.  Update  the  Deployable  Disbursing  System  signature  block  to  require  the  System 
Administrator  to  select  the  appointment  that  correlates  to  the  individual  appointment  letters. 

b.  Add  user  privileges  to  the  Deployable  Disbursing  System  user  account  list. 

c.  Develop  a  user  role  that  identifies  the  substitute  user  processing  Deployable  Disbursing 
System  transactions  for  outside  agents. 

Management  Comments: 

a.  Concur.  Maintenance  of  individual  appointment  letters  is  an  administrative  control  of  the 
Disbursing  Officer  and  is  not  a  requirement  of  a  disbursing  system.  The  recommended 
capability  will  be  presented  to  the  SDI  CCB  for  consideration.  Next  SDI  CCB  scheduled  for 
January  2010. 

h.  Concur.  System  Change  Request  written  and  being  impacted  by  TSO.  Acceptance  of 
requirements  and  scheduled  completion  date  to  be  determined  by  the  SDI  CCB  expected  to 
meet  in  January  2010. 

c.  Concur.  System  Change  Request  written  and  being  impacted  by  TSO.  Acceptance  of 
requirements  and  scheduled  completion  date  to  be  determined  by  the  SDI  CCB  expected  to 
meet  in  January  2010. 

F.stimatcd  Completion  Date:  December  20 1 0 


Recommendation  B.l:  We  recommend  that  the  Assistant  Deputy  Commandant,  Programs  and 
Resources  Department;  and  Fiscal  Director  of  the  United  States  Marine  Corps,  in  conjunction 
w  ith  the  Director,  Defense  Finance  and  Accounting  Service: 

a.  Locate  the  missing  Deployable  Disbursing  System  data  for  the  81 5  United  States  Marine 
Corps'  disbursement  transactions  not  provided  by  the  Deployable  Disbursing  System 
Program  Management  Office.  If  they  are  unable  to  locate  these  missing  transactions,  the 
United  States  Marine  Corps  should  research  the  transactions  and  reconstruct  the  Deployable 
Disbursing  System  data. 

b.  Develop  and  maintain  a  centralized  database  olThe  transactions  processed  through  the 
Deployable  Disbursing  System. 


40 


Management  Comments: 

a.  Concur.  I  hc  DDS  PMO  and  Marine  Corps  Disbursing  Office  Systems  Support  (MCDOSS) 
have  w  orked  together  to  locate  659  of  the  8 1 5  missing  transactions  in  DDS.  The  remaining 
1 56  documents  have  been  located  and  all  data  will  be  provided  to  the  DoDIG  team. 

b.  Concur,  fhe  DDS  PMO  completed  development  of  the  central  repository  and  it  should  be 
operational  in  November  2009. 


Estimated  Completion  Date:  November  2009. 

Recommendation  B.2:  We  recommend  that  the  Director,  Defense  Finance  and  Accounting 
Scrs  ice.  establish  a  time-phased  plan  to  modify  the  Deployable  Disbursing  System  to: 

a.  Capture  the  name  of  the  certifying  officer  signing  the  vouchers  to  refiect  the  actual  certifier. 

b.  Require  users  to  enter  the  contract  number  or  requisition  number  for  commercial  payments. 

c.  Eliminate  the  pre-population  of  the  invoice  received  date  field  with  the  current  business  date 
while  maintaining  the  requirement  to  enter  an  invoice  received  date. 

d.  Capture  the  invoice  number(s)  for  commercial  payments  and  maintain  the  ability  to  validate 
for  duplicate  invoice  numbers. 

e.  Capture,  within  the  archive  data,  the  identity  of  an  individual  who  pays  or  certifies  a  voucher. 

Management  Comments:  Concur  on  all  five  items.  System  Change  requests  are  written  and 
being  impacted  by  fSO.  Acceptance  of  requirements  and  scheduled  completion  date  to  be 
determined  by  the  SDl  CCB  expected  to  meet  in  January  2010. 

F.stimatcd  Completion  Date:  December  2010. 
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